janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVSS
No CVSS.
References
Configurations
Configuration 1 (hide)
|
History
30 Apr 2025, 16:39
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Janrywang depath
Janrywang |
|
| References | () https://github.com/janryWang/depath/issues/11 - Exploit | |
| References | () https://gist.github.com/mestrtee/32c0a48023036e51918f6a098f21953d - Exploit | |
| CPE | cpe:2.3:a:janrywang:depath:1.0.6:*:*:*:*:*:*:* cpe:2.3:a:janrywang:depath:1.1.2:*:*:*:*:*:*:* |
28 Mar 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-28 21:15
Updated : 2025-04-30 16:39
NVD link : CVE-2024-38985
Mitre link : CVE-2024-38985
JSON object : View
Products Affected
janrywang
- depath
CWE
No CWE.