What’s Vulnerable › Vulnerabilities

CVE-2024-23339: hoolock does not block Prototype pollution with object-path related utilities

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-22 · updated 2026-06-17
• Weakness: CWE-1321

Description

hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block attempts to access or alter object prototypes. Starting in version 2.2.1, the `get`, `set` and `update` functions throw a `TypeError` when a user attempts to access or alter inherited properties.

Affected products

• elijahharry hoolock: from 2.0.0 before 2.2.1 — fixed in 2.2.1

How to fix

Upgrade to a fixed version: elijahharry hoolock 2.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/elijahharry/hoolock/commit/97ae80e856774335d92743c635ffeae2f652b982
• https://github.com/elijahharry/hoolock/security/advisories/GHSA-4c2g-hx49-7h25
• https://github.com/elijahharry/hoolock/commit/97ae80e856774335d92743c635ffeae2f652b982
• https://github.com/elijahharry/hoolock/security/advisories/GHSA-4c2g-hx49-7h25

Get alerted when CVE-2024-23339 or the next vulnerability affects your stack