Prototype Pollution in deap
Summary
GHSA-xrmp-99wj-p6jc: Prototype Pollution in deap. Affects deap versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
deap is an npm package that provides a framework for evolutionary algorithms in Python. It is used for solving optimization problems by simulating the process of natural selection. The package offers various features and utilities for creating and manipulating genetic algorithms. However, versions of deap before 1.0.1 are vulnerable to prototype pollution.
Vulnerability Detail
Prototype pollution is a vulnerability that occurs when an attacker can inject properties into existing objects. In the case of deap, this vulnerability allows an attacker to modify the prototype of objects, leading to unexpected behavior and potential security issues. The impact of this vulnerability can range from data integrity issues to remote code execution.
How To Fix
Latest published version: 1.0.1 as of 23 Oct 2026
npm install deap@1.0.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Prototype pollution in deap can lead to unexpected behavior and potential security issues. It is crucial to update deap to version 1.0.1 or later to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for deap →
FAQ
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of objects, leading to unexpected behavior and potential security issues.
The impact of this vulnerability can range from data integrity issues to remote code execution, depending on how it is exploited.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Unfortunately, there is no known workaround for this vulnerability. It is recommended to update deap to the latest version to mitigate the risk.
You can find more information about this vulnerability in the advisory published by GitHub at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-xrmp-99wj-p6jc/GHSA-xrmp-99wj-p6jc.json
References
Related vulnerabilities
Recent vulnerabilities recorded for deap.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
