Description
deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.
Remediation
References
https://snyk.io/vuln/SNYK-JS-DEEPLY-451026
Related Vulnerabilities
CVE-2022-21126 Vulnerability in maven package com.github.samtools:htsjdk
CVE-2023-49620 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-common
CVE-2022-0436 Vulnerability in maven package org.webjars.npm:grunt
CVE-2021-32012 Vulnerability in npm package xlsx
CVE-2013-4152 Vulnerability in maven package org.springframework:spring-oxm