CVE-2024-38985

The vulnerability lies in the setIn() function located in the lib/index.js file (line 90), called by the set() method. An attacker can pass specially crafted object properties (e.g., __proto__, constructor, or prototype) that modify the prototype of the base JavaScript object. Prototype pollution causes properties injected by the attacker to be inherited by all objects in the application, which can lead to arbitrary code execution or disruption of application functionality.

An attacker can remotely execute arbitrary code on the server (RCE) or cause service unavailability (DoS). Full compromise of system confidentiality, integrity, and availability is possible.

Apply patches available from the vendor according to the references. As a workaround, consider rejecting or sanitizing input data containing keys such as __proto__, constructor, or prototype before passing them to the set() method.

janryWang depath v1.0.6 and cool-path v1.1.2