GHSA-pjxw-22xf-6pwc

ghsaUSosv

Prototype Pollution in defaults-deep

view advisory published 2019-02-07Licence: CC-BY-4.0

All versions of `defaults-deep` are vulnerable to prototype pollution. Provided certain input `defaults-deep` can add or modify properties of the `Object` prototype. These properties will be present on all objects. ## Recommendation As no patch is currently available for this vulnerability it is our recommendation to select another module that can provide this functionality.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-16486US	critical9.8OT elevated	1.48% (74th)	—	2019-02-01
A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-pjxw-22xf-6pwcADVISORY
https://github.com/jonschlinkert/defaults-deepPACKAGE
https://hackerone.com/reports/380878WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-16486ADVISORY
https://www.npmjs.com/advisories/778WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan