Update dependency object-path to ^0.11.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
object-path	^0.9.2 → ^0.11.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Prototype pollution in object-path

CVE-2020-15256 / GHSA-cwx2-736x-mf6w

More information

Details

Impact

A prototype pollution vulnerability has been found in object-path <= 0.11.4 affecting the set() method. The vulnerability is limited to the includeInheritedProps mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of set() in versions < 0.11.0 is vulnerable.

Patches

Upgrade to version >= 0.11.5

Workarounds

Don't use the includeInheritedProps: true options or the withInheritedProps instance if using a version >= 0.11.0.

References

Read more about the prototype pollution vulnerability

For more information

If you have any questions or comments about this advisory:

• Open an issue in object-path

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

References

• https://github.com/mariocasciaro/object-path/security/advisories/GHSA-cwx2-736x-mf6w
• https://github.com/mariocasciaro/object-path/commit/2be3354c6c46215c7635eb1b76d80f1319403c68
• https://nvd.nist.gov/vuln/detail/CVE-2020-15256
• https://github.com/advisories/GHSA-cwx2-736x-mf6w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Prototype Pollution in object-path

CVE-2021-23434 / GHSA-v39p-96qg-c8rf

More information

Details

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

Severity

• CVSS Score: 5.6 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-23434
• https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e8994ef154cab9eb
• https://github.com/mariocasciaro/object-path#0116
• https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453
• https://github.com/mariocasciaro/object-path%230116
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423
• https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html
• https://github.com/advisories/GHSA-v39p-96qg-c8rf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Prototype Pollution in object-path

CVE-2021-3805 / GHSA-8v63-cqqc-6r2c

More information

Details

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). The del() function fails to validate which Object properties it deletes. This allows attackers to modify the prototype of Object, causing the modification of default properties like toString on all objects.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-3805
• https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053
• https://github.com/mariocasciaro/object-path/commit/4f0903fd7c832d12ccbe0d9c3d7e25d985e9e884
• https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html
• https://github.com/advisories/GHSA-8v63-cqqc-6r2c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mariocasciaro/object-path (object-path)

v0.11.8

Compare Source

v0.11.7

Compare Source

v0.11.6

Compare Source

v0.11.5

Compare Source

v0.11.4

Compare Source

v0.11.3

Compare Source

v0.11.2

Compare Source

v0.11.1

Compare Source

v0.11.0

Compare Source

v0.10.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request