GHSA-4c2g-hx49-7h25MediumCVSS 6.3

Prototype pollution not blocked by object-path related utilities in hoolock

Published
January 23, 2024
Last Modified
November 12, 2024

🔗 CVE IDs covered (1)

CVE-2024-23339 →

📋 Description

Impact

Utility functions related to object paths (get, set and update) did not block attempts to access or alter object prototypes.

Patches

The get, set and update functions will throw a TypeError when a user attempts to access or alter inherited properties in versions >=2.2.1.

🎯 Affected products1

  • npm/hoolock:>= 2.0.0, < 2.2.1

🔗 References (4)