CVE-2021-23518

CVE-2021-23518 affects cached-path-relative (before 1.1.0). The root cause is prototype pollution: the cache variable is created as {} instead of Object.create(null) in the cachedPathRelative function, allowing access to parent prototype properties when building the cached relative path. When ori...

CVE-2018-16472

CVE-2018-16472 affects the Node.js module cached-path-relative (versions ≤ 1.0.1). The issue is prototype pollution: an attacker can inject properties on Object.prototype, which are then inherited by all objects and can lead to denial of service. Connected sources confirm the vulnerable component...