CVE-2022-24802: Prototype Pollution in deepmerge-ts
Summary
CVE-2022-24802: Prototype Pollution in deepmerge-ts. Affects deepmerge-ts versions < 4.0.2. Fixed in 4.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
deepmerge-ts is an npm package that is used to merge two or more objects while respecting type information. It provides a convenient way to combine objects in JavaScript and TypeScript applications. However, deepmerge-ts is vulnerable to Prototype Pollution, which is a type of vulnerability that allows an attacker to modify the prototype of an object and potentially execute arbitrary code. This vulnerability exists in the file deepmerge.ts, specifically in the function defaultMergeRecords(). The impact of this vulnerability can be severe, as it can lead to unauthorized access, data manipulation, or even remote code execution.
Vulnerability Detail
The vulnerability in deepmerge-ts arises due to improper handling of user-supplied input during the merging process. By manipulating the input objects, an attacker can inject malicious properties into the prototype chain of the merged object. This can result in unexpected behavior or the execution of unintended code when the merged object is used elsewhere in the application. The vulnerability has been assigned a CVSS score of 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
4.0.2
This is the first release that contains the fix.
npm install deepmerge-ts@4.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is crucial to update to the fixed version of deepmerge-ts to mitigate the risk effectively.
Conclusion
Prototype Pollution in deepmerge-ts is a critical vulnerability that can lead to unauthorized access, data manipulation, or remote code execution. It is crucial to update to version 4.0.2 or later to mitigate this risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for deepmerge-ts →
FAQ
deepmerge-ts is an npm package used for merging objects in JavaScript and TypeScript applications while preserving type information. It simplifies the process of combining multiple objects into a single object.
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object. By injecting malicious properties into the prototype chain, the attacker can manipulate the behavior of the object and potentially execute arbitrary code.
The impact of this vulnerability can be severe. It can lead to unauthorized access, data manipulation, or even remote code execution. Exploiting this vulnerability can have serious consequences for the security and integrity of the affected application.
To fix this vulnerability, update deepmerge-ts to version 4.0.2 or later. This update includes a patch that addresses the Prototype Pollution issue. By updating to the latest version, you can ensure that the vulnerable code is replaced with the fixed version.
Currently, there is no known workaround for this vulnerability. It is essential to update to the fixed version of deepmerge-ts to effectively mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for deepmerge-ts.
