CVE-2021-41097

Prototype pollution in aurelia-path

aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`.

Affected

aurelia · path

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v3.1 GITHUB

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

4.90% chance of exploitation in the next 30 days, 92nd percentile

Nuclei

high · CWE-1321

Published

2021-09-27

Updated

2024-08-04

Proof-of-concept exploits (1)

• aurelia/path/issues/4420★ · 2024-12-18

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41097.yaml

Security advisories

• aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv
• https://www.npmjs.com/package/aurelia-path
• advisories/GHSA-3c9c-2p65-qvwv

References

• CVE Record
• NVD entry