jeeeyul/underscore-keypath

jeeeyul/underscore-keypath

GitHubGitHub
GitHubgithub.com
Releases20
Frequency1 month 1 week
Last Release
Stars17
Key-Path mechanism extensions for underscore
Log in to subscribe

CVE History

CVEAffectedPublishedCVSS v3CVSS v2
CVE-2023-26139NVD↗
>= 0.0.11, >= 0.0.11, <= 0.9.37.5 HIGH—

Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “__proto__”.