Description
The npm @cookiex/deep package before version 0.0.7 has a prototype pollution vulnerability. The global proto object can be polluted using the proto object.
Recommendation
Update the @cookiex/deep package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.0.7
- Patched version(s): 0.0.7
References
Could your website be exposed too?
SmartScanner can check your website for Prototype Pollution in cookiex/deep and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype Pollution in record-like-deep-assign - CVE-2021-23402
- deep-defaults vulnerable to prototype pollution - CVE-2021-25944
- set-deep-prop Prototype Pollution - CVE-2021-23373
- Prototype Pollution in deep-override - CVE-2021-25941
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023