high7.5
CVE-2019-10745
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0.
Impact
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Assign-Deep Project | Assign-Deep | before 0.4.8 Version 1.0.0 |