express-requests-loggly (>=0.1.0 <=0.1.2), mongoose-power-populate (>=1.0.0 <=1.3.4) +5 more potentially affected by CVE-2021-23507 via object-path-set (>=0.0.1 <=0.0.2)

object-path-set NPM version =0.0.1, =0.1.0, =1.0.0, =0.2.3, =0.2.0, =0.1.0, =0.1.0, =1.0.0, =1.1.1 Source cves: CVE-2021-23507 Source advisory: OSV:GHSA-H6PR-C536-6RJG...

CVE-2021-23507

CVE-2021-23507 affects the npm package object-path-set . Versions before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, enabling an attacker to merge properties into object prototypes. Impact can include denial of service or potential remote code execution, per the provided r...

CVE-2021-23507 Prototype Pollution

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908...