CVE-2020-7751 pathval Prototype Pollution Vulnerability with PoC

Vulnerability Key Information Overview Vulnerability Type: Prototype Pollution Affected Package: pathval Affected Versions: <1.1.1 Release Date: 2020-07-30 CVE ID: CVE-2020-7751 CVE Classification: CWE-1321 Remediation Remediation Recommendation: Upgrade pathval to version 1.1.1 or higher Vulnerability Details Summary: pathval retrieves object values given a string path. Affected versions are vulnerable to prototype pollution. PoC: Details: Prototype pollution vulnerabilities allow attackers to overwrite or pollute JavaScript application object prototypes by injecting values, potentially leading to remote code execution or denial of service. Two main ways to pollute prototypes: - Unsafe recursive object merging - Setting properties via path Attack Types Denial of Service (DoS) Remote Code Execution Property Injection Affected Environments Application Servers Web Servers Web Browsers Prevention Measures 1. Freeze the prototype - Use 2. Enforce JSON input schema validation 3. Avoid using unsafe recursive merge functions 4. Use objects without prototypes (e.g., ) 5. Use instead of References CVSS Base Score: Snyk Score 6 (Medium), NVD Score 7.2 (High) CVSS Base Score Details: - Attack Vector: Network - Attack Complexity: Low - Required Privileges: High - User Interaction: None - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2020-7751 pathval Prototype Pollution Vulnerability with PoC