CVE-2023-26139

2023-08-0105:15:34

CWE-1321

snyk

web.nvd.nist.gov

cve-2023-26139

package vulnerability

underscore-keypath

prototype pollution

input sanitization

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

35.0%

JSON

Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “proto”.

Affected configurations

Nvd

Node

underscore-keypath_projectunderscore-keypathRange0.0.11≥node.js

VendorProductVersionCPE
underscore-keypath_projectunderscore-keypath*cpe:2.3:a:underscore-keypath_project:underscore-keypath:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
underscore-keypath_project	underscore-keypath	*	cpe:2.3:a:underscore-keypath_project:underscore-keypath::::::node.js::*

CNA Affected

[
  {
    "product": "underscore-keypath",
    "versions": [
      {
        "version": "0.0.11",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]