What is GHSA-gpvc-mx6g-cchv?

GHSA-gpvc-mx6g-cchv is a security advisory published by GitHub Security Advisories with High severity. underscore-keypath vulnerable to Prototype Pollution

Which CVE IDs does GHSA-gpvc-mx6g-cchv cover?

GHSA-gpvc-mx6g-cchv covers the following CVE IDs: CVE-2023-26139. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gpvc-mx6g-cchv?

GHSA-gpvc-mx6g-cchv has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-gpvc-mx6g-cchv?

GHSA-gpvc-mx6g-cchv affects 1 product, including: npm/underscore-keypath:\u003e= 0.0.11, \u003c= 0.9.3.

GHSA-gpvc-mx6g-cchvHighCVSS 7.5

underscore-keypath vulnerable to Prototype Pollution

Vendor

GitHub Security Advisories

Published

August 1, 2023

Last Modified

November 29, 2023

🔗 CVE IDs covered (1)

CVE-2023-26139 →

📋 Description

Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like __proto__.

🎯 Affected products1

npm/underscore-keypath:>= 0.0.11, <= 0.9.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-26139
https://gist.github.com/lelecolacola123/cc0d1e73780127aea9482c05f2ff3252
https://security.snyk.io/vuln/SNYK-JS-UNDERSCOREKEYPATH-5416714
https://github.com/advisories/GHSA-gpvc-mx6g-cchv