CVE-2020-15256

CVE-2020-15256 describes a critical prototype pollution vulnerability in the 'object-path' library, specifically affecting versions 0.11.4 and earlier when using the 'set()' method. This flaw is particularly impactful when the 'includeInheritedProps' mode is explicitly enabled or the default 'withInheritedProps' instance is used in versions 0.11.0 and above, or in any usage of 'set()' in versions prior to 0.11.0. Rated with a CVSS score of 9.8 (CRITICAL), this vulnerability has a network attack vector and low attack complexity, requiring no privileges or user interaction. Successful exploitation could lead to high impacts on confidentiality, integrity, and availability, allowing attackers to manipulate object prototypes and potentially execute arbitrary code or cause denial of service. While there is no evidence of active exploitation (KEV: No) and no known public exploit code (Metasploit, Nuclei, ExploitDB: None), the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness among security researchers. The issue is fixed in 'object-path' version 0.11.5, and a workaround involves avoiding the 'includeInheritedProps: true' option or 'withInheritedProps' instance in affected versions.