What is GHSA-8j4w-5fw4-rm27?

GHSA-8j4w-5fw4-rm27 is a security advisory published by GitHub Security Advisories with Critical severity. Prototype Pollution in deeply

Which CVE IDs does GHSA-8j4w-5fw4-rm27 cover?

GHSA-8j4w-5fw4-rm27 covers the following CVE IDs: CVE-2019-10750. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8j4w-5fw4-rm27?

GHSA-8j4w-5fw4-rm27 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-8j4w-5fw4-rm27?

GHSA-8j4w-5fw4-rm27 affects 1 product, including: npm/deeply:\u003c 3.1.0.

GHSA-8j4w-5fw4-rm27CriticalCVSS 9.8

Prototype Pollution in deeply

Vendor

GitHub Security Advisories

Published

August 27, 2019

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2019-10750 →

📋 Description

Versions of deeply prior to 1.0.1 are vulnerable to Prototype Pollution. The package fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.

Recommendation

Upgrade to version 3.1.0 or later.

🎯 Affected products1

npm/deeply:< 3.1.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-10750
https://snyk.io/vuln/SNYK-JS-DEEPLY-451026
https://www.npmjs.com/advisories/1030
https://github.com/advisories/GHSA-8j4w-5fw4-rm27