Prototype pollution vulnerability in 'deepref

Description

Prototype pollution vulnerability in ‘deepref’ versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 1.1.1, <= 1.2.1

References

• GHSA-7c7g-72q7-4xhm
• CVE-2020-28274
• CAPEC-310
• OWASP 2021-A6

Related Issues

• dot-prop Prototype Pollution vulnerability - CVE-2020-8116
• eivindfjeldstad-dot contains prototype pollution vulnerability - CVE-2020-7639
• Prototype pollution vulnerability in 'libnested - CVE-2020-28283
• Prototype pollution vulnerability in 'deep-set - CVE-2020-28276

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

deepref