CVE-2024-23339
Medium
Description
hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block attempts to access or alter object prototypes. Starting in version 2.2.1, the `get`, `set` and `update` functions throw a `TypeError` when a user attempts to access or alter inherited properties.
SeverityMedium
CVSS6.3
Exploit probability—
ProductElijahharry Hoolock
PublishedJan 22, 2024
First seenJan 22, 2024
Weakness typeCWE-1321Prototype pollution
How to fix
Update
- elijahharry hoolock2.2.1 or later
- hoolock2.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elijahharry hoolock | 2.0.0 ≤ v < 2.2.1 | 2.2.1 |
| hoolocknpm | 2.0.0 ≤ v < 2.2.1 | 2.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.