GitHub Advisoryadvisory · npm

GHSA-3829-mgmw-jcg4 Prototype Pollution in deep.assign

CRITICAL Published 2022-07-01 Modified 2022-07-11 Official page ↗

Aliases: CVE-2021-40663
Ecosystem: npm
Packages: deep.assign
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-1321
Reviewed: 2022-07-06

Affected packages

• npm deep.assign: 0.0.0-alpha.0 (no fix yet)

Description

deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

Related

Alias · CVE (1)

CVE-2021-40663 deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype… vulnerability

Weakness · CWE (1)

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References