GHSA-653v-rqx9-j85p
deep-object-diff vulnerable to Prototype Pollution
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | deep-object-diff | >= 1.1.6, < 1.1.9 | 1.1.9 |
Details
As written in the advisory (Markdown source, shown as plain text).
deep-object-diff before version 1.1.6 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the `__proto__` property to be edited. This issue was fixed in version 1.1.9.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-41713
- https://github.com/mattphillips/deep-object-diff/issues/85
- https://github.com/mattphillips/deep-object-diff/issues/85#issuecomment-1312450353
- https://github.com/mattphillips/deep-object-diff/pull/87/commits/55f9c3c70cf0d54cb30291e949fb8682fa3c5d9f
- https://github.com/mattphillips/deep-object-diff/pull/87/commits/9576963b68b955e88610aa4f0c696a1aafc1119d
- https://fluidattacks.com/advisories/heldens
- https://github.com/mattphillips/deep-object-diff