CVE-2022-24802CWE-915

Prototype Pollution in deepmerge-ts

High · published March 31, 2022

CVSS v3.1
8.1
EPSS
2%
Percentile
76.7
In the wild
Unconfirmed
What it is

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01678 · 76.7th percentile
Weakness
CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2022-03-31T23:15Z
EPSS history
Timeline
  • 31 MAR 23:15Z
    Prototype Pollution in deepmerge-ts
    cvelistv5