Object Path · Object-Path · CVE-2020-15256
**Name of the Vulnerable Software and Affected Versions**
object-path versions <= 0.11.4
**Description**
A prototype pollution vulnerability has been found in the `set()` method of the `object-path` library. The vulnerability is limited to the `includeInheritedProps` mode, which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5.
**Recommendations**
For versions <= 0.11.4, upgrade to version 0.11.5 to fix the issue.
As a temporary workaround, do not use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.