Vulnetix
Try Vulnetix Request Demo
CVE-2021-23434 PUBLISHED

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

EPSS 0.20% · 42.2th percentile

Risk Scores

EPSS Score
0.20%
42.2th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSnode-object-path0, 0.11.3-1
Ubuntu:24.04:LTSnode-object-path0, *
Ubuntu:20.04:LTSnode-object-path0, 0.11.4-2
Ubuntu:25.10node-object-path0, 0.11.8+~0.11.1-2

Timeline

References

Open in Interactive Console →