Traverse
Monthly
Prototype pollution in the npm package traverse (versions 0.3.6-0.3.9, 0.4.0-0.4.6, 0.5.0-0.5.2, and 0.6.0-0.6.11) lets unauthenticated remote attackers add or overwrite properties on String.prototype, Number.prototype, or Boolean.prototype when an application passes an attacker-controlled path array to set(), as when a path is built directly from an untrusted JSON body. Exploitation is gated entirely on that anti-pattern: the path must cross or end on a primitive value, and plain JSON data is not sufficient to reach the far higher-impact Object.prototype, which requires a non-data path segment such as an object whose toString returns a different value on each call or a Proxy that accepts an assignment without storing it. Impact is limited to low integrity and low availability with no confidentiality effect (vendor CVSS 4.0 score 6.9 Medium; independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no public exploit identified at time of analysis and confirmed fixes available from the vendor in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Prototype pollution in the npm package traverse (versions 0.3.6-0.3.9, 0.4.0-0.4.6, 0.5.0-0.5.2, and 0.6.0-0.6.11) lets unauthenticated remote attackers add or overwrite properties on String.prototype, Number.prototype, or Boolean.prototype when an application passes an attacker-controlled path array to set(), as when a path is built directly from an untrusted JSON body. Exploitation is gated entirely on that anti-pattern: the path must cross or end on a primitive value, and plain JSON data is not sufficient to reach the far higher-impact Object.prototype, which requires a non-data path segment such as an object whose toString returns a different value on each call or a Proxy that accepts an assignment without storing it. Impact is limited to low integrity and low availability with no confidentiality effect (vendor CVSS 4.0 score 6.9 Medium; independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no public exploit identified at time of analysis and confirmed fixes available from the vendor in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.