Cyber Resilience

CVE-2024-38985

CriticalPublic PoC

Published: 28 March 2025

Published
28 March 2025
Modified
30 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0039 60.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-38985 is a critical-severity Prototype Pollution (CWE-1321) vulnerability in Janrywang Depath. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-38985 is a prototype pollution vulnerability affecting janryWang products depath v1.0.6 and cool-path v1.1.2. The flaw occurs via the set() method at setIn (lib/index.js:90), enabling attackers to inject arbitrary properties into prototypes. Published on 2025-03-28, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-1321.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation allows arbitrary code execution or denial of service (DoS) by injecting malicious properties that pollute object prototypes.

Advisories and related resources include a GitHub issue for depath at https://github.com/janryWang/depath/issues/11 and a proof-of-concept gist at https://gist.github.com/mestrtee/32c0a48023036e51918f6a098f21953d.

EU & UK References

Vulnerability details

janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

CWE(s)
CWE-1321

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

Remote unauthenticated RCE via prototype pollution in exposed JS library directly enables T1190 (public-facing app exploitation) and T1059.007 (JavaScript command execution).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-24292Shared CWE-1321
CVE-2026-33228Shared CWE-1321
CVE-2026-44966Shared CWE-1321
CVE-2026-26021Shared CWE-1321
CVE-2026-25881Shared CWE-1321
CVE-2026-25754Shared CWE-1321
CVE-2024-12629Shared CWE-1321
CVE-2026-24888Shared CWE-1321
CVE-2026-28794Shared CWE-1321
CVE-2026-2964Shared CWE-1321

Affected Assets

janrywang
depath
1.0.6, 1.1.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
preventrecover

Requires timely identification, reporting, and correction of the prototype pollution flaw in depath v1.0.6 and cool-path v1.1.2, directly preventing arbitrary code execution and DoS exploitation.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Vulnerability monitoring and scanning identifies the presence of CVE-2024-38985 in deployed software components like depath and cool-path.

SI-10 Information Input Validation partial match
prevent

Validates inputs to the vulnerable setIn method to block injection of arbitrary properties that enable prototype pollution.

References