CVE-2021-23438

CVE-2021-23438 is a critical type confusion vulnerability affecting the mpath package before version 0.8.4, which can bypass a previous security fix (CVE-2018-16490). This flaw stems from incorrect type handling when comparing array elements, specifically when Array.prototype.indexOf() is used instead of String.prototype.indexOf(). With a CVSS score of 9.8, it presents a severe risk with a network attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.