GHSA-4xg3-7w7q-856q

Source

https://github.com/advisories/GHSA-4xg3-7w7q-856q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-4xg3-7w7q-856q/GHSA-4xg3-7w7q-856q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4xg3-7w7q-856q

Aliases

CVE-2024-36582

Published

2024-06-17T15:30:54Z

Modified

2024-06-17T22:12:25Z

Summary

object-deep-assign Prototype Pollution

Details

alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)

Database specific

{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-06-17T21:37:37Z",
    "nvd_published_at":  "2024-06-17T15:15:51Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / @alexbinary/object-deep-assign

Package

Name: @alexbinary/object-deep-assign; View open source insights on deps.dev
Purl: pkg:npm/%40alexbinary/object-deep-assign

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.0.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-4xg3-7w7q-856q/GHSA-4xg3-7w7q-856q.json"