The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.02821·Published 2020-08-18·Fixed in 4.7.0CWE-1321