GitHub Advisoryadvisory · npm

GHSA-xg47-r67p-vhv5 Improper Input Validation in Deap

CRITICAL Published 2022-05-14 Modified 2022-06-28 Official page ↗
Aliases
CVE-2018-3749
Ecosystem
npm
Packages
deap
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2022-06-28

Affected packages

• npm deap: < 1.0.1 → fixed in 1.0.1

Description

The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Related

Alias · CVE (1)

  • CVE-2018-3749 The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References