Critical Prototype Pollution Vulnerability in node-deep-extend Package
Summary
UBUNTU-CVE-2018-3750: The utilities function in all versions. Affects node-deep-extend versions 0.4.1-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-deep-extend package is a utility module for Node.js that allows for deep merging of objects. It is commonly used in various applications to extend objects with properties from other objects. However, versions up to 0.5.0 are vulnerable to a prototype pollution issue, which can be exploited if an attacker can manipulate the input structure.
Vulnerability Detail
The vulnerability arises from the utilities function in the deep-extend module, which can be tricked into modifying the prototype of the Object. This occurs when an attacker controls part of the structure passed to the function, allowing them to add or modify properties that will exist on all objects. This can lead to severe consequences, including unauthorized access to sensitive data or the execution of malicious code. The CVSS score for this vulnerability is 9.8, indicating a critical level of risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the deep-extend module in your application until you can update to a secure version. Additionally, validate and sanitize any input structures that are passed to the utilities function to mitigate the risk of exploitation.
Conclusion
The node-deep-extend package has a critical vulnerability that can lead to prototype pollution, allowing attackers to manipulate object properties. It is crucial to update to the latest version of the package to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for node-deep-extend →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of built-in objects in JavaScript, potentially leading to unauthorized access or modification of properties.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file, such as package-lock.json, to check for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, modification of application behavior, or execution of arbitrary code, posing significant risks to application security.
Yes, you can temporarily avoid using the deep-extend module and validate any input structures to reduce the risk of exploitation until you can update to a secure version.
Detailed information about this vulnerability can be found in the official security notice on GitHub and various security advisory platforms.
Related vulnerabilities
Recent vulnerabilities recorded for node-deep-extend.
