~ / search / GHSA-4xg3-7w7q-856q

GHSA-4xg3-7w7q-856q

object-deep-assign Prototype Pollution

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-36582

Packages

EcosystemPackageAffectedFixed in
npm @alexbinary/object-deep-assign <= 1.0.11 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)

References

External links from the advisory. They lead to third-party sites.