Description
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
Remediation
References
https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211
Related Vulnerabilities
CVE-2023-44487 Vulnerability in maven package io.helidon.http:helidon-http-http2
CVE-2017-16007 Vulnerability in npm package node-jose
CVE-2022-37734 Vulnerability in maven package com.graphql-java:graphql-java
CVE-2021-23429 Vulnerability in npm package transpile
CVE-2016-3081 Vulnerability in maven package org.apache.struts:struts2-core