{"id":"GHSA-v39p-96qg-c8rf","summary":"Prototype Pollution in object-path","details":"This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition `currentPath === '__proto__'` returns false if `currentPath` is `['__proto__']`. This is because the `===` operator returns always false when the type of the operands is different.","aliases":["CVE-2021-23434"],"modified":"2025-01-08T10:41:52.160502Z","published":"2021-09-01T18:37:11Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2021-08-30T18:16:08Z","nvd_published_at":"2021-08-27T17:15:00Z","cwe_ids":["CWE-1321","CWE-843"],"severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23434"},{"type":"WEB","url":"https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e8994ef154cab9eb"},{"type":"PACKAGE","url":"https://github.com/mariocasciaro/object-path"},{"type":"WEB","url":"https://github.com/mariocasciaro/object-path#0116"},{"type":"WEB","url":"https://github.com/mariocasciaro/object-path%230116"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453"}],"affected":[{"package":{"name":"object-path","ecosystem":"npm","purl":"pkg:npm/object-path"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.11.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-v39p-96qg-c8rf/GHSA-v39p-96qg-c8rf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}