Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “__proto__”.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
CWE-1321
Vulnerability Title
underscore-keypath 安全漏洞
Vulnerability Description
underscore-keypath是一个 JavaScript 库，用于处理对象的键路径操作。键路径操作是指通过字符串指定对象中的嵌套属性或属性路径，并在对象上进行读取、设置和操作。underscore-keypath 库提供了一组简单且灵活的方法，用于处理复杂的对象结构，实现在嵌套对象中获取和设置属性的值。 underscore-keypath 0.0.11及更高版本存在安全漏洞，该漏洞源于setProperty()函数的name参数存在原型污染。
CVSS Information
N/A
Vulnerability Type
N/A