What is GHSA-4h4x-4m75-47j4?

GHSA-4h4x-4m75-47j4 is a security advisory published by GitHub Security Advisories with High severity. depath and cool-path vulnerable to Prototype Pollution via `set()` Method

Which CVE IDs does GHSA-4h4x-4m75-47j4 cover?

GHSA-4h4x-4m75-47j4 covers the following CVE IDs: CVE-2024-38985. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-4h4x-4m75-47j4?

GHSA-4h4x-4m75-47j4 affects 2 products, including: npm/depath:\u003c= 1.0.6; npm/cool-path:\u003c= 1.1.2.

GHSA-4h4x-4m75-47j4High

depath and cool-path vulnerable to Prototype Pollution via `set()` Method

Vendor

GitHub Security Advisories

Published

March 28, 2025

Last Modified

March 31, 2025

🔗 CVE IDs covered (1)

CVE-2024-38985 →

📋 Description

janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

🎯 Affected products2

npm/depath:<= 1.0.6
npm/cool-path:<= 1.1.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-38985
https://github.com/janryWang/depath/issues/11
https://gist.github.com/mestrtee/32c0a48023036e51918f6a098f21953d
https://github.com/advisories/GHSA-4h4x-4m75-47j4