{"id":"CVE-2024-29650","aliases":["EUVD-2024-0878","GHSA-8ppr-www8-hfjx"],"status":"published","title":"@thi.ng/paths Prototype Pollution vulnerability","description":"An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01404,"percentile":0.72755,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2024-03-25T00:00:00Z","modified":"2026-06-17T07:22:55Z","fixes":[{"ecosystem":"npm","package":"@thi.ng/paths","fixed_in":["5.1.63"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@thi.ng/paths","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.63"}]}]},{"source":"osv","ecosystem":"npm","package":"@thi.ng/paths","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.1.63"}]}]}],"products":[{"vendor":"thi-ng","product":"paths"}],"references":[{"url":"https://gist.github.com/tariqhawis/1bc340ca5ea6ae115c9ab9665cfd5921","tags":["x_transferred","web"]},{"url":"https://learn.snyk.io/lesson/prototype-pollution/#a0a863a5-fd3a-539f-e1ed-a0769f6c6e3b","tags":["x_transferred","web"]},{"url":"https://www.vicarius.io/vsociety/posts/unwinding-cve-2024-29650-a-tale-of-javascript-source-code-review-to-unravel-the-mysterious-prototype-pollution-amid-of-loose-defenses"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29650","tags":["advisory"]},{"url":"https://github.com/thi-ng/umbrella/issues/445","tags":["web"]},{"url":"https://github.com/thi-ng/umbrella/commit/c78b484882ad5214a46ef83ddb8020571c171353","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8ppr-www8-hfjx"},{"url":"https://github.com/thi-ng/umbrella","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-29650","description":"An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.","status":"published","published":"2024-03-25T00:00:00Z","modified":"2024-08-23T20:20:42.428Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-0878","description":"An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.","status":"published","published":"2024-03-25T00:00:00Z","modified":"2024-08-23T20:20:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:11.81667Z"}],"ghsa":[{"id":"GHSA-8ppr-www8-hfjx","title":"@thi.ng/paths Prototype Pollution vulnerability","description":"An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the `mutIn` and `mutInManyUnsafe` components.","status":"published","published":"2024-03-25T15:30:41Z","modified":"2024-08-02T15:59:15Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:57.422393Z"}],"nvd":[{"id":"CVE-2024-29650","description":"An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.","status":"published","published":"2024-03-25T15:15:52.38Z","modified":"2026-06-17T07:22:55.45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"GHSA-8ppr-www8-hfjx","title":"@thi.ng/paths Prototype Pollution vulnerability","description":"An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the `mutIn` and `mutInManyUnsafe` components.","status":"published","published":"2024-03-25T15:30:41Z","modified":"2024-08-02T15:59:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:42.78452Z"}]}}