CVE-2024-23339

Deeper analysis

hoolock is a lightweight JavaScript utility library whose object-path functions get, set, and update were affected by a prototype-pollution flaw (CWE-1321). Versions 2.0.0 through 2.2.0 accepted attacker-controlled property paths without validating whether the target was an inherited prototype property, allowing direct read or write access to Object.prototype.

An unauthenticated remote attacker who can supply a crafted path argument—typically through user-controlled input processed by one of these functions—can add or modify properties on the global Object prototype. Successful exploitation yields limited impacts on confidentiality, integrity, and availability, consistent with the reported CVSS 6.3 vector that requires user interaction but no privileges.

The project’s security advisory GHSA-4c2g-hx49-7h25 and the associated commit 97ae80e instruct users to upgrade to version 2.2.1 or later; the patched functions now throw a TypeError whenever an operation targets an inherited property, eliminating the prototype-pollution vector.

EPSS scores have remained flat at 0.1234 with no material increase after disclosure.