Prototype Pollution in deep-get-set

Description

All versions of package deep-get-set are vulnerable to Prototype Pollution via the ‘deep’ function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715

Recommendation

No fix is available yet. Followings are affected versions:

<= 1.1.1

References

GHSA-mjjj-6p43-vhhv
snyk.io
CVE-2022-21231
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Prototype Pollution in deep-get-set and gives you actionable findings to investigate.

Start a free scan

Related Issues

Prototype Pollution in deep-get-set - deep-get-set - CVE-2020-7715
deep-object-diff vulnerable to Prototype Pollution - CVE-2022-41713
deep-parse-json vulnerable to Prototype Pollution - CVE-2022-42743
Prototype pollution vulnerability in 'deep-set - CVE-2020-28276

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated January 27, 2023