GitHub Advisoryadvisory · npm

GHSA-mjjj-6p43-vhhv Prototype Pollution in deep-get-set

HIGH Published 2022-06-25 Modified 2022-06-29 Official page ↗
Aliases
CVE-2022-21231
Ecosystem
npm
Packages
deep-get-set
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321
Reviewed
2022-06-29

Affected packages

• npm deep-get-set: <= 1.1.1 (no fix yet)

Description

All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715

Related

Alias · CVE (1)

  • CVE-2022-21231 All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References