GitHub Advisoryadvisory · npm

GHSA-x7q7-fchv-8h2j @ranfdev/deepobj has a Prototype Pollution vulnerability

HIGH Published 2026-05-14 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-46509
Ecosystem
npm
Packages
@ranfdev/deepobj
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Weaknesses
CWE-1321
Reviewed
2026-05-14

Affected packages

• npm @ranfdev/deepobj: < 1.0.3 → fixed in 1.0.3

Description

Impact Prototype pollution is possible when property paths contain `__proto__`/`constructor`/`prototype`. The property path must not be exposed as user input.

Related

Alias · CVE (1)

  • CVE-2026-46509 deepobj provides get, set, delete deep objects in javascript. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References