Description
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
Remediation
References
https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211
Related Vulnerabilities
CVE-2023-46589 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2019-16869 Vulnerability in maven package org.jboss.netty:netty
CVE-2017-16222 Vulnerability in npm package elding
CVE-2022-25876 Vulnerability in npm package link-preview-js
CVE-2020-13929 Vulnerability in maven package org.apache.zeppelin:zeppelin