CVE-2018-16472

Vulnerability

The cached-path-relative npm package prior to version 1.0.2 is vulnerable to prototype pollution. An attacker can inject arbitrary properties into Object.prototype through the package's functions, affecting all JavaScript objects via the prototype chain. This issue affects versions <=1.0.1 [1][2].

Exploitation

Exploitation requires the attacker to pass a specially crafted object to a function in the package (e.g., via user input). By setting properties like __proto__ or constructor.prototype, the attacker pollutes the global prototype. No authentication or special privileges are required beyond the ability to supply arguments to the vulnerable functions [2][4].

Impact

Successful exploitation leads to a denial of service (DoS). Polluting Object.prototype can cause unexpected behavior, crashes, or infinite loops in applications that process objects, due to inherited properties. The impact is limited to application availability, with no evidence of remote code execution or data disclosure [1][3].

Mitigation

Upgrade cached-path-relative to version 1.0.2 or later, which contains the fix. No workarounds have been published. The package is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [3].