PT-2025-13571 · Cool-Path+1 · Cool-Path+1

Published 2025-03-28 · Updated 2025-04-01 · CVE-2024-38985

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions janryWang depath version 1.0.6 janryWang cool-path version 1.1.2

Description The vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. This is achieved through a prototype pollution via the set() method at setIn (lib/index.js:90).

Recommendations For janryWang depath version 1.0.6, consider disabling the setIn function in lib/index.js until a patch is available. For janryWang cool-path version 1.1.2, restrict access to the setIn function in lib/index.js to minimize the risk of exploitation.

Exploit

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-38985

GHSA-4H4X-4M75-47J4

Affected Products

Cool-Path

Depath

References · 12

• 🔥 https://github.com/janryWang/depath/issues/11 · Exploit
• 🔥 https://gist.github.com/mestrtee/32c0a48023036e51918f6a098f21953d · Exploit
• https://osv.dev/vulnerability/CVE-2024-38985 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4h4x-4m75-47j4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38985 · Security Note
• https://github.com/janryWang/depath · Note
• https://twitter.com/VulmonFeeds/status/1905874206975312252 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1905822807902040201 · Twitter Post
• https://twitter.com/CVEnew/status/1905811724046881196 · Twitter Post
• https://t.me/cvetracker/20222 · Telegram Post
• https://t.me/cvenotify/117258 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1905822817968324749 · Twitter Post