CVE-2024-23339

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block attempts to access or alter object prototypes. Starting in version 2.2.1, the `get`, `set` and `update` functions throw a `TypeError` when a user attempts to access or alter inherited properties.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1321

Affected software

Vendor	Product	Versions
elijahharry	hoolock	>= 2.0.0, < 2.2.1

References

Timeline

Published: Jan 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-23346.4The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all ver CVE-2024-233405.3@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Requ CVE-2024-233416.1TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting senten CVE-2024-233427.4The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital CVE-2024-233446.5Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted i CVE-2024-233455.4Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier th CVE-2024-233467.8Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in th CVE-2024-233477.8Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of CVE-2024-233488.8Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3 CVE-2024-233495.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apach CVE-2024-23356.4The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget link URLs in all versions up to, an CVE-2024-233506.5Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed