org.webjars.npm:deepmerge@4.3.1

latest version

4.3.1

latest non vulnerable version

4.0.0

first published

10 years ago

latest version published

3 years ago

licenses detected

MIT
[0.2.10,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:deepmerge package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Prototype Pollution Affected versions of this package are vulnerable to Prototype Pollution via `mergeObject()`, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a `__proto__` key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks. Notes: The proposed fix in PR #274 denies proto by name in both merge loops and adds regression tests. The PR was closed without merging and the main branch still contains the vulnerable guard. The maintainer closed the issue as “completed” without a technical rebuttal. Per them, they will not review the fix Scope: According to the tests, a plain {} target is guarded. The global Object.prototype is not modified, and Impact is limited to the object returned by merge(). How to fix Prototype Pollution? There is no fixed version for `org.webjars.npm:deepmerge`.	[4.2.0,)

Prototype Pollution

Affected versions of this package are vulnerable to Prototype Pollution via mergeObject(), which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a __proto__ key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks.

Notes:

The proposed fix in PR #274 denies proto by name in both merge loops and adds regression tests. The PR was closed without merging and the main branch still contains the vulnerable guard.
The maintainer closed the issue as “completed” without a technical rebuttal. Per them, they will not review the fix
Scope: According to the tests, a plain {} target is guarded. The global Object.prototype is not modified, and Impact is limited to the object returned by merge().

How to fix Prototype Pollution?

There is no fixed version for org.webjars.npm:deepmerge.

[4.2.0,)

Go back to all versions of this package