What is GHSA-9g9w-hmvj-5h57?

GHSA-9g9w-hmvj-5h57 is a security advisory published by GitHub Security Advisories with High severity. Prototype Pollution in merge-deep

Which CVE IDs does GHSA-9g9w-hmvj-5h57 cover?

GHSA-9g9w-hmvj-5h57 covers the following CVE IDs: CVE-2018-3722. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9g9w-hmvj-5h57?

GHSA-9g9w-hmvj-5h57 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-9g9w-hmvj-5h57?

GHSA-9g9w-hmvj-5h57 affects 1 product, including: npm/merge-deep:\u003c 3.0.1.

GHSA-9g9w-hmvj-5h57HighCVSS 8.8

Prototype Pollution in merge-deep

Vendor

GitHub Security Advisories

Published

July 26, 2018

Last Modified

September 7, 2023

🔗 CVE IDs covered (1)

CVE-2018-3722 →

📋 Description

Versions of merge-deep before 3.0.1 are vulnerable to prototype pollution via merging functions.

Recommendation

Update to version 3.0.1 or later.

🎯 Affected products1

npm/merge-deep:< 3.0.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-3722
https://hackerone.com/reports/310708
https://github.com/advisories/GHSA-9g9w-hmvj-5h57
https://www.npmjs.com/advisories/580
https://github.com/jonschlinkert/merge-deep/commit/2c33634da7129a5aefcc262d2fec2e72224404e5