Description
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
Remediation
References
https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211
Related Vulnerabilities
CVE-2021-41411 Vulnerability in maven package org.drools:drools-core
CVE-2021-31522 Vulnerability in maven package org.apache.kylin:kylin-server-base
CVE-2022-46175 Vulnerability in maven package org.webjars.bower:json5
CVE-2021-39157 Vulnerability in npm package detect-character-encoding
CVE-2023-3431 Vulnerability in maven package net.sourceforge.plantuml:plantuml