CVE-2021-25941: Prototype Pollution in deep-override
Summary
CVE-2021-25941: Prototype Pollution in deep-override. Affects deep-override versions >= 1.0.0, < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'deep-override' package is an npm package that provides functionality for deep object property overriding. It allows users to modify and override properties of nested objects. This package is vulnerable to a prototype pollution vulnerability in versions 1.0.0 through 1.0.1. Prototype pollution is a vulnerability that occurs when an attacker can inject properties into existing objects, potentially leading to a denial of service or remote code execution.
Vulnerability Detail
The prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to manipulate the prototype of objects, leading to a potential denial of service and remote code execution. By injecting malicious properties into existing objects, an attacker can modify the behavior of the application and potentially execute arbitrary code. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
npm install deep-override@1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update to the latest version of the 'deep-override' package to address the issue.
Conclusion
The 'deep-override' package is vulnerable to a critical prototype pollution vulnerability in versions 1.0.0 through 1.0.1. This vulnerability can lead to a denial of service and remote code execution. It is crucial to update to version 1.0.2 or later of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for deep-override →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can inject properties into existing objects, potentially leading to a denial of service or remote code execution.
This vulnerability can allow an attacker to modify the behavior of the application and potentially execute arbitrary code, leading to a denial of service or remote code execution.
Versions 1.0.0 through 1.0.1 of the 'deep-override' package are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to version 1.0.2 or later of the 'deep-override' package.
There is no known workaround for this vulnerability. It is strongly advised to update to the latest version of the 'deep-override' package to address the issue.
