CVE-2023-26139

Name of the Vulnerable Software and Affected Versions underscore-keypath versions 0.0.11 and later

Description The issue arises from improper input sanitization in the setProperty() function, allowing the usage of arguments like proto and leading to Prototype Pollution. This can be exploited due to the lack of proper input validation.

Recommendations For versions 0.0.11 and later, consider disabling the setProperty() function until a patch is available to prevent exploitation. Restrict the use of the name argument in the setProperty() function to minimize the risk of Prototype Pollution. Avoid using arguments like proto in the setProperty() function until the issue is resolved.