CVE-2021-23438

9.8 criticalEPSS 1.7%

Critical (9.8) in mpath project mpath. EPSS 1.7% chance of exploitation in the next 30 days. Fixed in mpath 0.8.4.

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-843
Published: 2021-09-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mpath_project:mpath

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-p92x-r36w-9395	npm	mpath	<0.8.4	0.8.4

References

Check your stack JSON