MEDIUM5.6

GHSA-6g47-63mv-qpgh

Prototype Pollution in dotty

Quick fix

GHSA-6g47-63mv-qpgh — dotty: upgrade to the fixed version with the command below.

npm install dotty@0.1.2

Details

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/dotty

Introduced in: 0Fixed in: 0.1.2

Fixnpm install dotty@0.1.2

References

https://nvd.nist.gov/vuln/detail/CVE-2021-23624[ADVISORY]
https://github.com/deoxxa/dotty/commit/88f61860dcc274a07a263c32cbe9d44c24ef02d7[WEB]
https://github.com/deoxxa/dotty[PACKAGE]
https://snyk.io/vuln/SNYK-JS-DOTTY-1577292[WEB]