Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
CRITICAL severity

Prototype pollution in aurelia-pathGHSA-3c9c-2p65-qvwv

CRITICALFix: aurelia/path@7c4e235

GHSA-3c9c-2p65-qvwv is a critical-severity (CVSS 9.1) CWE-1321 vulnerability in aurelia-path. 1 public exploit reference exists, so weaponization risk is real. A fix is available for aurelia-path — see the affected versions and patch details below.

Also known asCVE-2021-41097
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
1 known
Exploitation data as of Oct 12, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
4.9%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs92th percentile — riskier than 92% of all scored CVEsHighest risk
2.85%6.49%10.1%13.8%11.7%4.9%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-3c9c-2p65-qvwv by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

50other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
aurelia-pathnpm
19Kdownloads / week

Description

Impact

The vulnerability exposes Aurelia application that uses aurelia-path package to parse a string. The majority of this will be Aurelia applications that employ the aurelia-router package. An example is this could allow an attacker to change the prototype of base object class Object by tricking an application to parse the following URL: https://aurelia.io/blog/?__proto__[asdf]=asdf

Patches

The problem should be patched in version 1.1.7. Any version earlier than this is vulnerable.

Workarounds

A partial work around is to free the Object prototype:

Object.freeze(Object.prototype)

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmaurelia-pathall versions1.1.7npm install aurelia-path@1.1.7

Affected Products

1 product · 1 configurations
Application
aurelia-pathbluespire
< 1.1.7
range
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

aurelia-path is part of the Aurelia platform and contains utilities for …

github.comNVDOct 2021

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for aurelia-path, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update aurelia-path to 1.1.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3c9c-2p65-qvwv is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How to detect GHSA-3c9c-2p65-qvwv

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id ghsa-3c9c-2p65-qvwv -u https://target
Template
Aurelia-Path < 1.1.7 - Prototype Pollution
Severity
high
Impact
Update to version 1.1.7 or later.
Remediation
Aurelia-path parseQueryString function was found vulnerable to prototype pollution via crafted __proto__ URL parameters.

Template by ProjectDiscovery nuclei-templates (0x_Akoko), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

### Impact The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf` ### Patches The problem should be patched in version `1.1.7`. Any version earlier than this is vulnerable. ### Workarounds A partial work around is to free the Object prototype: ```ts Object.freeze
O3 Security · Impact-Aware SCA

Is GHSA-3c9c-2p65-qvwv in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Prototype pollution in aurelia-path (Critical 9.1)