VYPR
← All advisories
Critical severity9.8NVD Advisory· Published May 20, 2024· Updated Apr 15, 2026

CVE-2024-24294

CVE-2024-24294

Description

A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@blackprint/enginenpm
>= 0.8.12, < 0.9.20.9.2

Patches

1
bd6b965b03c4

Fix prototype pollution

https://github.com/Blackprint/engine-jsStefansAryaMar 19, 2024via ghsa
commit
1 file changed · +6 −0
  • src/utils.js+6 −0 modified
    @@ -8,6 +8,9 @@ function setDeepProperty(obj, path, value, onCreate){
 	for(var i = 0, n = path.length-1; i < n; i++){
 		temp = path[i];
 
+		if(temp.constructor !== String && temp.constructor !== Number)
+			throw new Error("Object field must be Number or String, but found: " + JSON.stringify(temp));
+
 		// Disallow diving into internal JavaScript property
 		if(temp === "constructor" || temp === "__proto__" || temp === "prototype")
 			return;
@@ -24,6 +27,9 @@ function setDeepProperty(obj, path, value, onCreate){
 	}
 
 	temp = path[i];
+	if(temp.constructor !== String && temp.constructor !== Number)
+		throw new Error("Object field must be Number or String, but found: " + JSON.stringify(temp));
+
 	if(temp === "constructor" || temp === "__proto__" || temp === "prototype")
 		return;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.