What is CVE-2023-26139?

CVE-2023-26139 is a high-severity vulnerability in Underscore-Keypath Project, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 7.5/10. Published 2023-08-01.

How severe is CVE-2023-26139?

High severity. CVSS v3 base score is 7.5 out of 10.

Prototype Pollution in Underscore-Keypath Project

CVE-2023-26139

Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “__proto__”.

Vulnerability class: Prototype Pollution

EPSS: 0.007 (50.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Underscore-keypath_project Underscore-keypath
N/a Underscore-keypath — versions 0.0.11

Weakness classification (CWE)

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

References

report@snyk.io (Third Party Advisory)
report@snyk.io (Third Party Advisory)

Frequently asked questions

What is CVE-2023-26139?: CVE-2023-26139 is a high-severity vulnerability in Underscore-Keypath Project, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 7.5/10. Published 2023-08-01.
How severe is CVE-2023-26139?: High severity. CVSS v3 base score is 7.5 out of 10.