CVE-2018-16486 Prototype Pollution in defaults-deep
CriticalCVSS 9.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm defaults-deep(npm) | <= 0.2.4 | No fix listed |
| defaults-deep project defaults-deep | <= 0.2.4 | No fix listed |
| HackerOne defaults-deep | = <=0.2.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- hackerone.com exploit issue-tracking third-party-advisory
- github.com
- www.npmjs.com