high8.8
CVE-2018-3723
Prototype Pollution in defaults-deep
Impact
Versions of `default-deep` before 0.2.4 are vulnerable to prototype pollution ## Recommendation Update to version 0.2.4 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | defaults-deep | < 0.2.4 | 0.2.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Defaults-Deep Project | Defaults-Deep | before 0.2.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/jonschlinkert/defaults-deep/commit/c873f341327ad885ff4d0f23b3d3bca31b0343e5
- https://hackerone.com/reports/310514
- https://github.com/advisories/GHSA-cqp5-m4pq-gfgp
- https://nvd.nist.gov/vuln/detail/CVE-2018-3723
- https://www.npmjs.com/advisories/581