@ranfdev/deepobj CVE-2026-46509

Exploitation requires developers to pass unsanitized user-controlled input directly to @ranfdev/deepobj's property path parameters. The vulnerability description explicitly states: 'The property path must not be exposed as user input' - meaning default secure usage (hardcoded paths, internal logic) is NOT vulnerable. Attack succeeds only when applications accept external input (HTTP parameters, JSON payloads, file uploads, environment variables) and feed it to deepobj functions that manipulate object properties via paths. Network accessibility (AV:N) means the vulnerable endpoint must be reachable remotely, but no authentication (PR:N) or user interaction (UI:N) is required once the misconfigured code path exists. Non-vulnerable scenarios: applications using deepobj exclusively with static, developer-defined property paths.

The CVSS 8.2 score (High) with network attack vector (AV:N) and no required authentication (PR:N) appears severe, but real-world exploitability is constrained by a critical condition stated in the description: 'The property path must not be exposed as user input.' This means exploitation requires developers to pass unsanitized user input directly to deepobj's property path parameters - a configuration error rather than default behavior. The High Integrity impact (I:H) reflects prototype pollution's ability to alter application logic, bypass security controls, or enable privilege escalation, while Low Availability impact (A:L) suggests denial-of-service is secondary. No Confidentiality impact (C:N) indicates data exfiltration isn't the primary risk. Without EPSS scoring or KEV listing, widespread automated exploitation appears unlikely. However, publicly available GitHub advisory with technical details (GHSA-x7q7-fchv-8h2j) lowers the skill barrier for targeted attacks. Priority should focus on applications where user-controlled data flows into deepobj property paths - a code review exercise rather than blanket emergency patching.

An attacker identifies a Node.js API endpoint where user-supplied JSON is processed using @ranfdev/deepobj to set nested object properties. By sending a crafted request with property path '{"__proto__": {"isAdmin": true}}', the attacker pollutes the Object prototype, causing all subsequently created objects in the application to inherit 'isAdmin: true'. This bypasses authorization checks that rely on prototype-inherited properties, escalating privileges or enabling unauthorized data access. GitHub advisory GHSA-x7q7-fchv-8h2j provides technical exploitation details.