{"action":"Upgrade mpath to 0.8.4 or later.","affected":[{"fixed":"0.8.4","introduced":"0"}],"component":"mpath","cve_ids":["CVE-2021-23438"],"ecosystem":"npm","epss":0.01723,"exploited":false,"fixed_versions":["0.8.4"],"ghsa_id":"GHSA-p92x-r36w-9395","id":"tcs_01M5KG34H7B6KT9BFWQCMNRHSD","modified_at":"2025-01-14T09:12:14.202017Z","published_at":"2021-09-02T22:02:25Z","references":["https://osv.dev/vulnerability/GHSA-p92x-r36w-9395","https://nvd.nist.gov/vuln/detail/CVE-2021-23438","https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc","https://github.com/mongoosejs/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc","https://github.com/aheckmann/mpath","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548","https://snyk.io/vuln/SNYK-JS-MPATH-1577289"],"severity":{"label":"medium","score":5.6},"sources":[{"source":"osv","source_id":"GHSA-p92x-r36w-9395","url":"https://osv.dev/vulnerability/GHSA-p92x-r36w-9395"}],"summary":"Type confusion in mpath"}