npm cool-path vulnerabilities

Latest npm cool-path CVEs

Newest publication first

1. CVE-2024-38985 depath and cool-path vulnerable to Prototype Pollution via `set()` Method

   Published 2025-03-28

   Critical·CVSS 9.8 EPSS 0.81%

   janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary propert...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.