Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mariocasciaro/object-path
master @ e6bb638
5
Fixes
3
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Prototype Pollution: 5 prior fixes. Scrutinize any change in this area.
index.js: most-fixed (5 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Prototype Pollution: Attackers can bypass blocklists (e.g., of __proto__) by passing non-string, non-numeric path components (like arrays) that confuse the parser, leading to arbitrary prototype modification.
Prototype Pollution: When the 'includeInheritedProps' mode is explicitly enabled, the set() method historically failed to block magic properties, allowing direct modification of the global Object prototype.
Prototype Pollution: Deep property lookups and writes in `index.js` can modify the root prototype if paths are not canonicalized and checked for magic properties prior to resolution.