GitHub Advisoryadvisory · npm

GHSA-hr2v-3952-633q Prototype Pollution in deep-extend

CRITICAL Published 2018-10-09 Modified 2021-09-14 Official page ↗

Aliases: CVE-2018-3750
Ecosystem: npm
Packages: deep-extend
Severity: Critical
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-20
Reviewed: 2020-06-16

Affected packages

• npm deep-extend: < 0.5.1 → fixed in 0.5.1

Description

Versions of `deep-extend` before 0.5.1 are vulnerable to prototype pollution. Recommendation Update to version 0.5.1 or later.

Related

Alias · CVE (1)

CVE-2018-3750 The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when… vulnerability

Weakness · CWE (1)

CWE-20 Improper Input Validation weakness

References