GHSA-mjjj-6p43-vhhv

Prototype Pollution in deep-get-set

Source: GitHub Advisory Database (reviewed) High CVE-2022-21231

Packages

Ecosystem	Package	Affected	Fixed in
npm	deep-get-set	<= 1.1.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7715](https://security.snyk.io/vuln/SNYK-JS-DEEPGETSET-598666)

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-21231 advisory
https://github.com/acstll/deep-get-set package
https://snyk.io/vuln/SNYK-JS-DEEPGETSET-2342655 web