GitHub Advisoryadvisory · npm

GHSA-pjxw-22xf-6pwc Prototype Pollution in defaults-deep

CRITICAL Published 2019-02-07 Modified 2023-09-12 Official page ↗
Aliases
CVE-2018-16486
Ecosystem
npm
Packages
defaults-deep
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-345, CWE-400
Reviewed
2020-06-16

Affected packages

• npm defaults-deep: <= 0.2.4 (no fix yet)

Description

All versions of `defaults-deep` are vulnerable to prototype pollution. Provided certain input `defaults-deep` can add or modify properties of the `Object` prototype. These properties will be present on all objects. Recommendation As no patch is currently available for this vulnerability it is our recommendation to select another module that can provide this functionality.

Related

Alias · CVE (1)

  • CVE-2018-16486 A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto… vulnerability

Weakness · CWE (2)

  • CWE-345 Insufficient Verification of Data Authenticity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References