GitHub Advisoryadvisory · npm

GHSA-28mc-g557-92m7 @75lb/deep-merge Prototype Pollution vulnerability

HIGH Published 2024-07-30 Modified 2024-08-06 Official page ↗
Aliases
CVE-2024-38986
Ecosystem
npm
Packages
@75lb/deep-merge
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321
Reviewed
2024-07-31

Affected packages

• npm @75lb/deep-merge: < 1.1.2 → fixed in 1.1.2

Description

Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.

Related

Alias · CVE (1)

  • CVE-2024-38986 Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References