Deep
Monthly
Prototype pollution in the `@cleverbrush/deep` package (versions ≤ 4.4.0) allows a remote attacker to corrupt `Object.prototype` by supplying crafted JSON containing reserved JavaScript keys (`__proto__`, `constructor`, `prototype`) to the `deepExtend()` function without any privilege requirement. Any Node.js application that passes externally controlled input through `deepExtend()` is at risk of property injection affecting every plain object in the runtime, potentially enabling authentication bypass or logic manipulation downstream. A public exploit exists (GitHub issue #213); the vulnerability is not listed in CISA KEV, so widespread active exploitation is not confirmed at time of analysis.
Prototype pollution in the `@cleverbrush/deep` package (versions ≤ 4.4.0) allows a remote attacker to corrupt `Object.prototype` by supplying crafted JSON containing reserved JavaScript keys (`__proto__`, `constructor`, `prototype`) to the `deepExtend()` function without any privilege requirement. Any Node.js application that passes externally controlled input through `deepExtend()` is at risk of property injection affecting every plain object in the runtime, potentially enabling authentication bypass or logic manipulation downstream. A public exploit exists (GitHub issue #213); the vulnerability is not listed in CISA KEV, so widespread active exploitation is not confirmed at time of analysis.