Description
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
Remediation
References
https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211
Related Vulnerabilities
CVE-2021-31712 Vulnerability in npm package react-draft-wysiwyg
CVE-2021-23443 Vulnerability in npm package edge.js
CVE-2020-13973 Vulnerability in maven package com.mikesamuel:json-sanitizer
CVE-2018-3711 Vulnerability in npm package fastify
CVE-2023-27602 Vulnerability in maven package org.apache.linkis:linkis-dist