-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| underscore-keypath | npm | >= 0.0.11, <= 0.9.3 |
Miggo AIRoot Cause AnalysisThe vulnerability documentation explicitly identifies setProperty() as the entry point where improper input sanitization occurs. The provided PoC in the GitHub Gist shows obj[name] = value being executed with attacker-controlled 'name' values like 'proto.prop'. This direct assignment to object properties without prototype pollution checks is the root cause. While setValueForKeyPath() is the user-facing API, the actual vulnerable logic resides in setProperty().