GitHub Advisoryadvisory · npm

GHSA-8j4w-5fw4-rm27 Prototype Pollution in deeply

CRITICAL Published 2019-08-27 Modified 2021-08-17 Official page ↗
Aliases
CVE-2019-10750
Ecosystem
npm
Packages
deeply
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-400
Reviewed
2019-08-27

Affected packages

• npm deeply: < 3.1.0 → fixed in 3.1.0

Description

Versions of `deeply` prior to 1.0.1 are vulnerable to Prototype Pollution. The package fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. Recommendation Upgrade to version 3.1.0 or later.

Related

Alias · CVE (1)

  • CVE-2019-10750 deeply is vulnerable to Prototype Pollution in versions before 3.1.0. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References