Description
The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.
Remediation
References
https://github.com/Geta/NestedObjectAssign/pull/11
https://snyk.io/vuln/SNYK-JS-NESTEDOBJECTASSIGN-1065977
Related Vulnerabilities
CVE-2021-34801 Vulnerability in npm package valine
CVE-2022-29256 Vulnerability in maven package org.webjars.npm:sharp
CVE-2023-41887 Vulnerability in maven package org.openrefine:database
CVE-2023-37954 Vulnerability in maven package com.sonyericsson.hudson.plugins.rebuild:rebuild
CVE-2015-8315 Vulnerability in maven package org.webjars.npm:ms