~ / search / GHSA-66rh-8fw6-59q6

GHSA-66rh-8fw6-59q6

assign-deep Vulnerable to Prototype Pollution

Source: GitHub Advisory Database (reviewed) High CVE-2019-10745

Packages

EcosystemPackageAffectedFixed in
npm assign-deep < 0.4.8 0.4.8
npm assign-deep >= 1.0.0, < 1.0.1 1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `assign-deep` prior to 1.0.1 and 0.4.8 are vulnerable to Prototype Pollution. The `assign` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. ## Recommendation Upgrade to versions 1.0.1, 0.4.8, or later.

References

External links from the advisory. They lead to third-party sites.