~ / search / GHSA-8j4w-5fw4-rm27

GHSA-8j4w-5fw4-rm27

Prototype Pollution in deeply

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10750

Packages

EcosystemPackageAffectedFixed in
npm deeply < 3.1.0 3.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `deeply` prior to 1.0.1 are vulnerable to Prototype Pollution. The package fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. ## Recommendation Upgrade to version 3.1.0 or later.

References

External links from the advisory. They lead to third-party sites.