CVE-2018-16472

A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain causing a DoS attack.

Score

CVSS 3.1 7.5 High

Status

Modified - support@hackerone.com

Published

2018-11-06

Last modified

2024-08-05

Weaknesses

CWE-20, CWE-400

Affected products

• Cached-path-relative (Cached-path-relative Project)
• Debian Linux (Debian)
• Cached-path-relative (Npm)

References

• https://hackerone.com/reports/390847
• https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html