GitHub Advisoryadvisory · npm

GHSA-653v-rqx9-j85p deep-object-diff vulnerable to Prototype Pollution

MEDIUM Published 2022-11-04 Modified 2022-11-16 Official page ↗
Aliases
CVE-2022-41713
Ecosystem
npm
Packages
deep-object-diff
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1321
Reviewed
2022-11-08

Affected packages

• npm deep-object-diff: >= 1.1.6, < 1.1.9 → fixed in 1.1.9

Description

deep-object-diff before version 1.1.6 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the `__proto__` property to be edited. This issue was fixed in version 1.1.9.

Related

Alias · CVE (1)

  • CVE-2022-41713 deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References