CVE-2019-10745
mediumpriority · track · 30EPSS 0.011 · 67 %ileEUUSEPSS · scored 2026-10-27
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
- assign-deep project assign-deep< 0.4.8nvdUScpe:2.3:a:assign-deep_project:assign-deep:*:*:*:*:*:*:*:*
- assign-deep project assign-deep= 1.0.0nvdUScpe:2.3:a:assign-deep_project:assign-deep:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-66rh-8fw6-59q6assign-deep Vulnerable to Prototype Pollution2019-08-21ghsa · osvUS
Versions of `assign-deep` prior to 1.0.1 and 0.4.8 are vulnerable to Prototype Pollution. The `assign` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. ## Recommendation Upgrade to versions 1.0.1, 0.4.8, or later.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan