CVE-2024-38985

CRITICAL

janrywang depath and cool-path - Prototype Pollution via setIn Method

Title source: llm
STIX 2.1

Description

janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0064
EPSS Percentile 45.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-1321
Status published
Products (4)
janrywang/depath 1.0.6
janrywang/depath 1.1.2
npm/cool-path 0npm
npm/depath 0npm
Published Mar 28, 2025
Tracked Since Feb 18, 2026