VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Mar 28, 2025· Updated Jun 17, 2026

CVE-2024-38985

CVE-2024-38985

Description

janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
depathnpm
<= 1.0.6—
cool-pathnpm
<= 1.1.2—

Affected products

5
  • janryWang/depath3 versions
    cpe:2.3:a:janrywang:depath:1.0.6:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:janrywang:depath:1.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:janrywang:depath:1.1.2:*:*:*:*:*:*:*
    • (no CPE)
  • ghsa-coords2 versions
    pkg:npm/cool-pathpkg:npm/depath
    <= 1.1.2+ 1 more
    • (no CPE)range: <= 1.1.2
    • (no CPE)range: <= 1.0.6

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.