CVE-2021-3805: Prototype Pollution in object-path

Prototype Pollution vulnerabilities arise when an attacker can inject properties into the prototype of a built-in JavaScript object. This injected property is then inherited by all instances of that object, effectively poisoning the entire object hierarchy. In the context of object-path, a successful exploitation could allow an attacker to modify the behavior of the library, potentially leading to denial-of-service by corrupting data structures or introducing unexpected errors. While direct remote code execution is unlikely, the ability to manipulate object properties can have cascading effects throughout an application, impacting data integrity and potentially enabling privilege escalation depending on how the library is used.

1. Reserved2021-09-16
2. Published2021-09-17
3. Modified2024-08-03
4. EPSS updated2026-04-02

The primary mitigation for CVE-2021-3805 is to upgrade to version 0.11.8 or later of the object-path library. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing input validation and sanitization to prevent malicious data from being passed to the object-path library. Specifically, carefully scrutinize any user-supplied data used in path expressions. While a WAF cannot directly address prototype pollution, it can be configured to block requests containing suspicious path patterns. There are no specific Sigma or YARA rules available for this vulnerability, but monitoring for unusual object property modifications within your application's logs is recommended.