CVE-2024-23339
Elijahharry Hoolock 2.0.0 – 2.2.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-23339 is a medium-severity Prototype Pollution (CWE-1321) vulnerability in Elijahharry Hoolock. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 38% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
hoolock is a lightweight JavaScript utility library whose object-path functions get, set, and update were affected by a prototype-pollution flaw (CWE-1321). Versions 2.0.0 through 2.2.0 accepted attacker-controlled property paths without validating whether the target was an inherited prototype property, allowing direct read or write access to Object.prototype.
An unauthenticated remote attacker who can supply a crafted path argument—typically through user-controlled input processed by one of these functions—can add or modify properties on the global Object prototype. Successful exploitation yields limited impacts on confidentiality, integrity, and availability, consistent with the reported CVSS 6.3 vector that requires user interaction but no privileges.
The project’s security advisory GHSA-4c2g-hx49-7h25 and the associated commit 97ae80e instruct users to upgrade to version 2.2.1 or later; the patched functions now throw a TypeError whenever an operation targets an inherited property, eliminating the prototype-pollution vector.
EPSS scores have remained flat at 0.1234 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0244
Vulnerability Data
hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block attempts to access…
more
or alter object prototypes. Starting in version 2.2.1, the `get`, `set` and `update` functions throw a `TypeError` when a user attempts to access or alter inherited properties.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.