CVE-2020-7716: Prototype Pollution in deeps
Summary
CVE-2020-7716: Prototype Pollution in deeps. Affects deeps versions < 1.4.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
deeps is an npm package that provides functionality for deep merging and cloning of objects. It is commonly used in JavaScript applications to manipulate and modify complex data structures. However, versions up to and including 1.4.5 of deeps are vulnerable to Prototype Pollution via the set function.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior in the application. In the case of deeps, the set function is susceptible to Prototype Pollution, allowing an attacker to modify the prototype of an object and potentially execute arbitrary code or manipulate data. This can lead to various security risks, including remote code execution, data tampering, or denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the latest version of deeps to mitigate the risk of exploitation.
Conclusion
In conclusion, deeps versions up to and including 1.4.5 are vulnerable to Prototype Pollution via the set function. This vulnerability can have severe consequences, including remote code execution and data manipulation. It is highly recommended to update to the latest version of deeps (1.4.6 or higher) to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for deeps →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior in the application.
The impact of this vulnerability can vary depending on how the affected package is used. It can potentially lead to remote code execution, data tampering, or denial of service.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the maintainers of deeps have released a patch in version 1.4.6 that addresses the Prototype Pollution vulnerability. It is recommended to update to the latest version of deeps (1.4.6 or higher) to fix the vulnerability.
There are no known workarounds for this vulnerability. It is crucial to update to the latest version of deeps to mitigate the risk of exploitation.
