{"id":"CVE-2021-23438","aliases":["GHSA-p92x-r36w-9395"],"url":"https://o3.security/vulnerability/CVE-2021-23438","summary":"Type confusion in mpath","details":"This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.","published":"2021-09-01T19:15:07.440Z","modified":"2026-07-09T05:13:45.176155Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"npm","name":"mpath","fixedVersion":"0.8.4"}],"fix":{"url":"https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc","label":"aheckmann/mpath@89402d2"},"references":[{"type":"FIX","url":"https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JS-MPATH-1577289"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T05:13:45.176155Z"}}