GitHub Advisoryadvisory · npm

GHSA-cqp5-m4pq-gfgp Prototype Pollution in defaults-deep

HIGH Published 2018-07-26 Modified 2023-09-12 Official page ↗

Aliases: CVE-2018-3723
Ecosystem: npm
Packages: defaults-deep
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-471
Reviewed: 2020-06-16

Affected packages

• npm defaults-deep: < 0.2.4 → fixed in 0.2.4

Description

Versions of `default-deep` before 0.2.4 are vulnerable to prototype pollution Recommendation Update to version 0.2.4 or later.

Related

Alias · CVE (1)

CVE-2018-3723 defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious… vulnerability

Weakness · CWE (1)

CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

References