CVE-2021-23438

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

• CWE-843

• https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fcPatch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-MPATH-1577289Exploit, Third Party Advisory
• https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fcPatch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-MPATH-1577289Exploit, Third Party Advisory

Published

Sep 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23432This affects all versions of package mootools. This is due t…9.8
• CVE-2021-23433The package algoliasearch-helper before 3.6.2 are vulnerable…9.8
• CVE-2021-23434This affects the package object-path before 0.11.6. A type c…8.6
• CVE-2021-23435This affects the package clearance before 2.5.0. The vulnera…6.1
• CVE-2021-23436This affects the package immer before 9.0.6. A type confusio…9.8
• CVE-2021-23437The package pillow 5.2.0 and before 8.3.2 are vulnerable to …7.5
• CVE-2021-23439This affects the package file-upload-with-preview before 4.2…6.1
• CVE-2021-2344Vulnerability in the Oracle Coherence product of Oracle Fusi…7.5
• CVE-2021-23440This affects the package set-value before <2.0.1, >=3.0.0 <4…9.8
• CVE-2021-23441Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-23442This affects all versions of package @cookiex/deep. The glob…9.8
• CVE-2021-23443This affects the package edge.js before 5.3.2. A type confus…6.1