CVE-2021-3805

Description

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

How to fix CVE-2021-3805

To remediate CVE-2021-3805, upgrade the affected package to a fixed version below.

• Debian/node-object-path—upgrade to 0.11.5-3+deb11u1 or later
• npm/object-path—upgrade to 0.11.8 or later

Is CVE-2021-3805 being exploited?

Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 0.11.5-3+deb11u1
• from 0, < 0.11.8

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-3805
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-3805
• PATCHgithub.com/mariocasciaro/object-path
• WEBgithub.com/mariocasciaro/object-path/commit/4f0903fd7c832d12ccbe0d9c3d7e25d985e9e884