Description
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
Remediation
References
https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211
Related Vulnerabilities
CVE-2023-30515 Vulnerability in maven package io.jenkins.plugins:thycotic-devops-secrets-vault
CVE-2022-22965 Vulnerability in maven package org.springframework:spring-beans
CVE-2023-22493 Vulnerability in npm package rsshub
CVE-2022-21129 Vulnerability in npm package nemo-appium
CVE-2021-41042 Vulnerability in maven package org.eclipse.lyo:lyo-parent