Description

deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

Remediation

References

https://github.com/janbialostok/deep-assign/issues/1

https://security.netapp.com/advisory/ntap-20220826-0002/

https://www.npmjs.com/package/deep.assign

Related Vulnerabilities

CVE-2017-16157 Vulnerability in npm package censorify.tanisjr

CVE-2020-15366 Vulnerability in maven package org.webjars.bowergithub.ajv-validator:ajv

CVE-2023-37959 Vulnerability in maven package org.jenkins-ci.plugins:sumologic-publisher

CVE-2022-39236 Vulnerability in npm package matrix-js-sdk

CVE-2021-34079 Vulnerability in npm package docker-tester

Severity

Critical

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking Third Party Advisory Product