hoolock does not block Prototype pollution with object-path related utilities
Priority LOW 31CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block attempts to access or alter object prototypes. Starting in version 2.2.1, the `get`, `set` and `update` functions throw a `TypeError` when a user attempts to access or alter inherited properties.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01007 63rd percentileScored 2026-11-07
Fix Fixed hoolock (elijahharry): 2.2.1hoolock (npm): 2.2.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| elijahharry | hoolock | 2.0.0 to before 2.2.1 | 2.2.1 | Patch available | CNA |
| — | hoolock (npm) | 2.0.0 to before 2.2.1 | 2.2.1 | Patch available | GHSA-4c2g-hx49-7h25 |
- hoolock Vendorelijahharry Affected 2.0.0 to before 2.2.1 Fixed in 2.2.1 Patch available CNA
- hoolock (npm) Vendor— Affected 2.0.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-4c2g-hx49-7h25
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elijahharry:hoolock:*:*:*:*:*:node.js:*:* | 2.0.0 to before 2.2.1 | Vulnerable | elijahharry |
- cpe:2.3:a:elijahharry:hoolock:*:*:*:*:*:node.js:*:* Versions 2.0.0 to before 2.2.1 Vulnerable ·elijahharry
Remediation
- Fix · CNA hoolock (elijahharry) Fixed in 2.2.1
- Fix · GHSA-4c2g-hx49-7h25 hoolock (npm) Fixed in 2.2.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-23339
- 2026-10-03 Alias added: GHSA-4c2g-hx49-7h25
References
Sources
- CVE-2024-23339 · CVE Program
- CVE-2024-23339 · NVD
- FIRST EPSS
- GHSA-4c2g-hx49-7h25 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences