Fix other instances of prototype pollution vulnerability

ashaffer · Jan 19, 2022 · 40c73bf · 40c73bf
1 parent dfc753a
commit 40c73bf
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/lib/index.js b/lib/index.js
@@ -27,15 +27,15 @@ function cachedPathRelative (from, to) {
   // to invalidate the cache
   var cwd = process.cwd()
   if (cwd !== lastCwd) {
-    cache = {}
+    cache = Object.create(null)
     lastCwd = cwd
   }
 
   if (cache[from] && cache[from][to]) return cache[from][to]
 
   var result = relative.call(path, from, to)
 
-  cache[from] = cache[from] || {}
+  cache[from] = cache[from] || Object.create(null)
   cache[from][to] = result
 
   return result