CVE-2022-21231: Prototype Pollution in deep-get-set
Summary
CVE-2022-21231: Prototype Pollution in deep-get-set. Affects deep-get-set versions < 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The deep-get-set package is an npm package that provides a function called 'deep' for deep object manipulation. It allows users to access and modify nested properties of JavaScript objects. The package is widely used in various applications and libraries. However, all versions of deep-get-set are vulnerable to a Prototype Pollution vulnerability through the 'deep' function.
Vulnerability Detail
The Prototype Pollution vulnerability in deep-get-set allows an attacker to modify the prototype of an object, leading to potential security issues. By manipulating the input to the 'deep' function, an attacker can inject malicious properties or modify existing ones on the prototype chain. This can result in various attacks, such as remote code execution, denial of service, or information disclosure. The vulnerability was initially reported as CVE-2020-7715, but the fix was incomplete, leading to the current vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the deep-get-set package to a fixed version as soon as possible.
Conclusion
The deep-get-set package is vulnerable to a Prototype Pollution issue that can have severe security implications. It is crucial to update the package to a fixed version as soon as possible to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for deep-get-set →
FAQ
Deep-get-set is an npm package that provides a function called 'deep' for deep object manipulation. It allows users to access and modify nested properties of JavaScript objects.
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object. This can lead to various security issues, such as remote code execution or information disclosure.
To update the deep-get-set package, users can run the command 'npm update deep-get-set' in their project directory.
Yes, all versions of deep-get-set are vulnerable to the Prototype Pollution issue. It is recommended to update to the latest version that includes a fix for this vulnerability.
The consequences of this vulnerability can vary depending on the specific usage of the deep-get-set package. However, possible impacts include remote code execution, denial of service, or information disclosure.
References
Related vulnerabilities
Recent vulnerabilities recorded for deep-get-set.
