Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-23438

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-23438
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:40 UTC · Revision 1

Source evidence

CVE-2021-23438

core-osv · Original source

Published 1 Sept 2021, 19:15 UTC

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

osv:CVE-2021-23438
Complete source record
{
  "id": "88165ae136f5782ab4dc6f932b4861f6630211c9603c514a3b6212c0ad5173e3",
  "url": "https://osv.dev/vulnerability/CVE-2021-23438",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-23438",
    "summary": "This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.",
    "evidence": "osv:CVE-2021-23438",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2021-23438",
      "aliases": [
        "CVE-2021-23438",
        "GHSA-p92x-r36w-9395"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/mongoosejs/mpath",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "634a0fa0f97bf1d00791647e3094273ba360a9ed"
                },
                {
                  "fixed": "89402d2880d4ea3518480a8c9847c541f2d824fc"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:mpath_project:mpath:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.8.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "89402d2880d4ea3518480a8c9847c541f2d824fc"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.8.3",
            "0.8.2",
            "0.8.1",
            "0.8.0",
            "0.7.0",
            "0.6.0",
            "0.5.2",
            "0.5.1",
            "0.5.0",
            "0.4.1",
            "0.3.0",
            "0.2.1",
            "0.2.0",
            "0.1.1",
            "0.1.0",
            "0.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23438.json"
          }
        }
      ],
      "modified": "2026-10-20T10:54:32.448674225Z",
      "provider": "osv",
      "references": [
        "https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc",
        "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548",
        "https://snyk.io/vuln/SNYK-JS-MPATH-1577289"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-23438",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 385519,
  "published_at": "2021-09-01T19:15:07.44+00:00"
}