{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.1.2"}],"component":"cool-path","cve_ids":["CVE-2024-38985"],"ecosystem":"npm","epss":0.0081,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-4h4x-4m75-47j4","id":"tcs_01M5KF0FQHP08ND9NBDAF3R8TW","modified_at":"2025-03-31T16:24:38.764249Z","published_at":"2025-03-28T21:30:46Z","references":["https://osv.dev/vulnerability/GHSA-4h4x-4m75-47j4","https://nvd.nist.gov/vuln/detail/CVE-2024-38985","https://github.com/janryWang/depath/issues/11","https://gist.github.com/mestrtee/32c0a48023036e51918f6a098f21953d","https://github.com/janryWang/depath"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-4h4x-4m75-47j4#npm/cool-path","url":"https://osv.dev/vulnerability/GHSA-4h4x-4m75-47j4"}],"summary":"depath and cool-path vulnerable to Prototype Pollution via `set()` Method"}