Description
deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
Remediation
References
https://fluidattacks.com/advisories/buuren/
https://github.com/sibu-github/deep-parse-json
Related Vulnerabilities
CVE-2022-40664 Vulnerability in maven package org.apache.shiro:shiro-core
CVE-2020-12648 Vulnerability in maven package org.webjars.npm:tinymce
CVE-2018-3757 Vulnerability in npm package pdf-image
CVE-2023-23936 Vulnerability in maven package org.webjars.npm:undici
CVE-2022-44262 Vulnerability in maven package org.ff4j:ff4j-core