PatchTheCVECVE-2021-23518: The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable tha
CVE-2021-23518 is a high-severity flaw (CVSS 7.3) affecting cached-path-relative, debian linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from a
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.3 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.9% (top 20%) |
| CISA exploited list | No |
| Weakness | CWE-1321 |
| Published | 2022-01-21 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-23518?
cached-path-relative: upgrade to 1.1.0; debian linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2021-23518 being exploited?
CVE-2021-23518 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-23518 affect?
CVE-2021-23518 affects cached-path-relative, debian linux. Severity is high (CVSS 7.3). The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype prop
How urgent is CVE-2021-23518?
Priority 61/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist