CVE-2018-3750 Prototype Pollution in deep-extend
CriticalCVSS 9.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/node-deep-extend(Debian:12) | < 0.4.1-2 | 0.4.1-2 |
| debian/node-deep-extend(Debian:13) | < 0.4.1-2 | 0.4.1-2 |
| debian/node-deep-extend(Debian:14) | < 0.4.1-2 | 0.4.1-2 |
| npm deep-extend(npm) | < 0.5.1 | 0.5.1 |
| deep extend project deep extend | <= 0.5.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-3750 vendor-advisory
- nvd.nist.gov third-party-advisory
- hackerone.com exploit issue-tracking third-party-advisory
- github.com
- www.npmjs.com
- github.com patch
- bugs.debian.org issue-tracking