Description

assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.

Remediation

References

https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211

Related Vulnerabilities

CVE-2021-23327 Vulnerability in maven package org.webjars.npm:apexcharts

CVE-2022-47105 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core

CVE-2021-37304 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base

CVE-2020-27885 Vulnerability in maven package org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.store.feature

CVE-2023-47440 Vulnerability in npm package gladys

Severity

High

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Exploit Patch Third Party Advisory