critical9.8
CVE-2024-38986
@75lb/deep-merge Prototype Pollution vulnerability
Impact
Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @75lb/deep-merge | <= 1.1.1 | 1.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| 75lb | Deep-Merge | Version 1.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/mestrtee/b20c3aee8bea16e1863933778da6e4cb
- https://github.com/advisories/GHSA-28mc-g557-92m7
- https://nvd.nist.gov/vuln/detail/CVE-2024-38986
- https://github.com/75lb/deep-merge/issues/1
- https://github.com/75lb/deep-merge/commit/a68541fac3c2372f1ca67effad825990ad8046e1