-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @clickbar/dot-diver | npm | < 1.0.2 | 1.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from setByPath's lack of prototype pollution guards in its path traversal logic. The original code used a simple reduce() to access nested properties without checking hasOwnProperty, allowing attackers to traverse special prototype properties. The PoC demonstrates this by setting 'constructor.prototype.polluted', which modifies the Object prototype. The commit diff shows the fix added hasOwnProperty checks specifically in setByPath to prevent prototype property access, confirming this was the vulnerable function.