What is GHSA-hc9w-4p87-j549?

GHSA-hc9w-4p87-j549 is a security advisory published by GitHub Security Advisories with High severity. Prototype Pollution in cached-path-relative

Which CVE IDs does GHSA-hc9w-4p87-j549 cover?

GHSA-hc9w-4p87-j549 covers the following CVE IDs: CVE-2018-16472. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hc9w-4p87-j549?

GHSA-hc9w-4p87-j549 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-hc9w-4p87-j549?

GHSA-hc9w-4p87-j549 affects 1 product, including: npm/cached-path-relative:\u003c 1.0.2.

GHSA-hc9w-4p87-j549HighCVSS 7.5

Prototype Pollution in cached-path-relative

Vendor

GitHub Security Advisories

Published

November 7, 2018

Last Modified

February 4, 2023

🔗 CVE IDs covered (1)

CVE-2018-16472 →

📋 Description

Version of cached-path-relative before 1.0.2 are vulnerable to prototype pollution.

Recommendation

Update to version 1.0.2 or later.

🎯 Affected products1

npm/cached-path-relative:< 1.0.2

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2018-16472
https://github.com/ashaffer/cached-path-relative/issues/3
https://hackerone.com/reports/390847
https://github.com/advisories/GHSA-hc9w-4p87-j549
https://github.com/nodejs/security-wg/blob/master/vuln/npm/480.json
https://www.npmjs.com/advisories/739
https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html