Description

deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

Remediation

References

https://github.com/janbialostok/deep-assign/issues/1

https://security.netapp.com/advisory/ntap-20220826-0002/

https://www.npmjs.com/package/deep.assign

Related Vulnerabilities

CVE-2021-43788 Vulnerability in npm package nodebb

CVE-2023-5217 Vulnerability in npm package electron

CVE-2020-28277 Vulnerability in maven package org.webjars.npm:dset

CVE-2017-16179 Vulnerability in npm package dasafio

CVE-2020-27216 Vulnerability in maven package jetty:jetty

Severity

Critical

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking Third Party Advisory Product