CVE-2021-23518

Katalog CVE

CVSS 9.8 · Critical EPSS 1,9%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada cached-path-relative project cached-path-relative, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

Rincian

Terbit di NVD

21 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ashaffer/cached-path-relative/commit/40c73bf70c58add5aec7d11e4f36b93d144bb760 patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2348246 exploit · issue tracking · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-2342653 exploit · issue tracking · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html mailing list · advisory pihak ketiga