Description
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
Remediation
References
https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211
Related Vulnerabilities
CVE-2020-5259 Vulnerability in maven package org.webjars.bowergithub.dojo:dojox
CVE-2020-7626 Vulnerability in npm package karma-mojo
CVE-2021-34080 Vulnerability in npm package ssl-utils
CVE-2018-18628 Vulnerability in maven package ro.pippo:pippo-core
CVE-2018-1999024 Vulnerability in maven package org.webjars.npm:mathjax