CVE-2021-23518

 

Published at: - 21-01-2022 09:15

Last modified: - 27-01-2022 08:27

Total changes: - 3

Description

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• N/A-Exploit, Issue Tracking, Patch, Third Party Advisory
• N/A-Patch, Third Party Advisory
• N/A-Exploit, Issue Tracking, Patch, Third Party Advisory

 

Keywords

NVD

 

CVE-2021-23518

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures