GitHub Advisoryadvisory · npm

GHSA-r6rj-9ch6-g264 Prototype pollution in Merge-deep

CRITICAL Published 2021-06-07 Modified 2021-06-16 Official page ↗
Aliases
CVE-2021-26707
Ecosystem
npm
Packages
merge-deep
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2021-06-03

Affected packages

• npm merge-deep: < 3.0.3 → fixed in 3.0.3

Description

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.

Related

Alias · CVE (1)

  • CVE-2021-26707 The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References