GitHub Advisoryadvisory · npm

GHSA-66rh-8fw6-59q6 assign-deep Vulnerable to Prototype Pollution

HIGH Published 2019-08-21 Modified 2022-08-03 Official page ↗
Aliases
CVE-2019-10745
Ecosystem
npm
Packages
assign-deep
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1321, CWE-20, CWE-915
Reviewed
2019-08-21

Affected packages

• npm assign-deep: < 0.4.8 → fixed in 0.4.8 • npm assign-deep: >= 1.0.0, < 1.0.1 → fixed in 1.0.1

Description

Versions of `assign-deep` prior to 1.0.1 and 0.4.8 are vulnerable to Prototype Pollution. The `assign` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. Recommendation Upgrade to versions 1.0.1, 0.4.8, or later.

Related

Alias · CVE (1)

  • CVE-2019-10745 assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. vulnerability

Weakness · CWE (3)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-20 Improper Input Validation weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References