~ / search / GHSA-7qqq-gh2f-wq76

GHSA-7qqq-gh2f-wq76

ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-25907

Packages

EcosystemPackageAffectedFixed in
npm ts-deepmerge < 2.0.2 2.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the `merge` function.

References

External links from the advisory. They lead to third-party sites.