Improper Input Validation in Deap

Description

The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Recommendation

Update the deap package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.1
• Patched version(s): 1.0.1

References

• GHSA-xg47-r67p-vhv5
• hackerone.com
• CVE-2018-3749
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Improper Input Validation in url-js - CVE-2022-25839
• Cisco node-jose improper validation of JWT signature - CVE-2018-0114
• bson-objectid contains Improper input validation - CVE-2019-19729
• Improper Input Validation in sanitize-html - CVE-2021-26539

Tags:

npm

deap