Description
deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.
Remediation
References
https://snyk.io/vuln/SNYK-JS-DEEPLY-451026
Related Vulnerabilities
CVE-2017-16135 Vulnerability in npm package serverzyy
CVE-2022-41713 Vulnerability in maven package org.webjars.npm:deep-object-diff
CVE-2023-26144 Vulnerability in npm package graphql
CVE-2021-23330 Vulnerability in npm package launchpad
CVE-2022-25898 Vulnerability in maven package org.webjars.bower:jsrsasign