Description

Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.

Remediation

References

https://github.com/klaemo/deep-set/blob/103d650b3de1f5c6cf051236347ba59e7274cd07/index.js#L39

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28276

Related Vulnerabilities

CVE-2020-13128 Vulnerability in maven package com.googlecode.gwtupload:gwtupload

CVE-2021-23369 Vulnerability in npm package handlebars

CVE-2022-23106 Vulnerability in maven package io.jenkins:configuration-as-code

CVE-2018-8009 Vulnerability in maven package org.apache.hadoop:hadoop-common

CVE-2021-41167 Vulnerability in npm package modern-async

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory NVD-CWE-noinfo