GitHub Advisoryadvisory · npm

GHSA-92v9-xh2q-fq9f Prototype Pollution in cookiex/deep

HIGH Published 2021-09-20 Modified 2022-12-03 Official page ↗
Aliases
CVE-2021-23442
Ecosystem
npm
Packages
@cookiex/deep
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-09-20

Affected packages

• npm @cookiex/deep: < 0.0.7 → fixed in 0.0.7

Description

The npm @cookiex/deep package before version 0.0.7 has a prototype pollution vulnerability. The global proto object can be polluted using the __proto__ object.

Related

Alias · CVE (1)

  • CVE-2021-23442 This affects all versions of package @cookiex/deep. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References