object-deep-assign Prototype Pollution · CVE-2024-36582 · GitHub Advisory Database · GitHub

object-deep-assign Prototype Pollution

Moderate severity GitHub Reviewed Published Jun 17, 2024 to the GitHub Advisory Database • Updated Jun 17, 2024

Package

@alexbinary/object-deep-assign (npm)

Affected versions

<= 1.0.11

Patched versions

None

Description

alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)

References

Published by the National Vulnerability Database

Jun 17, 2024

Published to the GitHub Advisory Database Jun 17, 2024

Reviewed Jun 17, 2024

Last updated Jun 17, 2024