Prototype Pollution in deap

Description

Versions of deap before 1.0.1 are vulnerable to prototype pollution.

Recommendation

Update the deap package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.1
• Patched version(s): 1.0.1

References

• GHSA-xrmp-99wj-p6jc
• hackerone.com
• www.npmjs.com
• snyk.io
• CWE-400

Related Issues

• Prototype Pollution in lodash.mergewith - lodash.mergewith - Vulnerability
• angular Prototype Pollution vulnerability - CVE-2019-10768
• Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify - Vulnerability
• Prototype Pollution in unflatten - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

deap