{"action":"Upgrade object-path-set to 1.0.2 or later.","affected":[{"fixed":"1.0.2","introduced":"0"}],"component":"object-path-set","cve_ids":["CVE-2021-23507"],"ecosystem":"npm","epss":0.02125,"exploited":false,"fixed_versions":["1.0.2"],"ghsa_id":"GHSA-h6pr-c536-6rjg","id":"tcs_01M5KFTC5QBFA23FZW6JWSYYRW","modified_at":"2026-07-08T06:50:03.258827527Z","published_at":"2022-02-05T00:00:31Z","references":["https://osv.dev/vulnerability/GHSA-h6pr-c536-6rjg","https://nvd.nist.gov/vuln/detail/CVE-2021-23507","https://github.com/skratchdot/object-path-set/commit/2d67a714159c4099589b6661fa84e6d2adc31761","https://github.com/skratchdot/object-path-set","https://github.com/skratchdot/object-path-set/blob/577f5299fed15bb9edd11c940ff3cf0b9f4748d5/index.js%23L8","https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation","https://snyk.io/vuln/SNYK-JS-OBJECTPATHSET-2388576"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-h6pr-c536-6rjg","url":"https://osv.dev/vulnerability/GHSA-h6pr-c536-6rjg"}],"summary":"Prototype Pollution in object-path-set"}