CRITICAL9.8

GHSA-pjxw-22xf-6pwc

Prototype Pollution in defaults-deep

Details

All versions of `defaults-deep` are vulnerable to prototype pollution. Provided certain input `defaults-deep` can add or modify properties of the `Object` prototype. These properties will be present on all objects.

## Recommendation

As no patch is currently available for this vulnerability it is our recommendation to select another module that can provide this functionality.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/defaults-deep

Introduced in: 0

No fixed version published yet for defaults-deep (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-16486[ADVISORY]
https://hackerone.com/reports/380878[WEB]
https://github.com/advisories/GHSA-pjxw-22xf-6pwc[ADVISORY]
https://github.com/jonschlinkert/defaults-deep[PACKAGE]
https://www.npmjs.com/advisories/778[WEB]