EUVD-2021-2096

Malware in sbrugna...

GHSA-P92X-R36W-9395 Type confusion in mpath

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOfpartsi !== -1 returns -1 if partsi is 'proto'. This is because the method that has been called if the input is an array is...

Prototype Pollution

mpath is vulnerable to prototype pollution. The vulnerability exists due to the condition ignoreProperties.indexOfpartsi !== -1 giving an incorrect return value when the input is an array...