Deepmerge
Monthly
Prototype pollution in the deepmerge JavaScript library (all versions through 4.3.1) allows an attacker who controls a source object passed into a merge operation to inject properties such as '__proto__', 'constructor', or 'prototype' into the resulting object's prototype chain. The impact is latency-dependent: applications that merge untrusted data (for example, a JSON request body) and then read properties without own-property checks will silently inherit attacker-chosen values, which can corrupt application logic, bypass authorization checks, or influence downstream behaviour. The flaw is a library primitive rather than a standalone exploit, and no public exploit code was identified at time of analysis; the vendor CVSS 4.0 score of 8.7 reflects integrity impact only (VC:N/VA:N), and an independent assessment rates it considerably lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) because exploitation requires the consuming application to both pass attacker-controlled source objects and perform unchecked inherited-property reads.
Prototype pollution in the deepmerge JavaScript library (all versions through 4.3.1) allows an attacker who controls a source object passed into a merge operation to inject properties such as '__proto__', 'constructor', or 'prototype' into the resulting object's prototype chain. The impact is latency-dependent: applications that merge untrusted data (for example, a JSON request body) and then read properties without own-property checks will silently inherit attacker-chosen values, which can corrupt application logic, bypass authorization checks, or influence downstream behaviour. The flaw is a library primitive rather than a standalone exploit, and no public exploit code was identified at time of analysis; the vendor CVSS 4.0 score of 8.7 reflects integrity impact only (VC:N/VA:N), and an independent assessment rates it considerably lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) because exploitation requires the consuming application to both pass attacker-controlled source objects and perform unchecked inherited-property reads.