Description
deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.
Remediation
References
https://snyk.io/vuln/SNYK-JS-DEEPLY-451026
Related Vulnerabilities
CVE-2021-23342 Vulnerability in npm package docsify
CVE-2021-4264 Vulnerability in maven package org.webjars.npm:dustjs-linkedin
CVE-2022-31943 Vulnerability in maven package net.mingsoft:ms-mcms
CVE-2021-29441 Vulnerability in maven package com.alibaba.nacos:nacos-common
CVE-2014-0074 Vulnerability in maven package org.apache.shiro:shiro-core