Description
deep-object-diff before version 1.1.6 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited. This issue was fixed in version 1.1.9.
Recommendation
Update the deep-object-diff package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.1.6, < 1.1.9
- Patched version(s): 1.1.9
References
Could your website be exposed too?
SmartScanner can check your website for deep-object-diff vulnerable to Prototype Pollution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- deep-parse-json vulnerable to Prototype Pollution - CVE-2022-42743
- steal vulnerable to Prototype Pollution - CVE-2022-37258
- Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization - CVE-2026-6594
- steal vulnerable to Prototype Pollution via alias variable - CVE-2022-37265
You might also like:
See something that needs correcting? Let us knowUpdated January 28, 2023