Description
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Remediation
References
https://hackerone.com/reports/311333
Related Vulnerabilities
CVE-2020-11020 Vulnerability in npm package faye
CVE-2023-29566 Vulnerability in npm package dawnsparks-node-tesseract
CVE-2020-36185 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2020-13951 Vulnerability in maven package org.apache.openmeetings:openmeetings-server
CVE-2023-40350 Vulnerability in maven package org.jenkins-ci.plugins:docker-swarm