GHSA-f9cm-qmx5-m98h

Suggest an improvement
Source
https://github.com/advisories/GHSA-f9cm-qmx5-m98h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-f9cm-qmx5-m98h/GHSA-f9cm-qmx5-m98h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f9cm-qmx5-m98h
Aliases
Published
2018-11-01T14:45:42Z
Modified
2023-11-08T03:59:59Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Prototype Pollution in merge
Details

Versions of merge before 1.2.1 are vulnerable to prototype pollution. The merge.recursive function can be tricked into adding or modifying properties of the Object prototype.

Recommendation

Update to version 1.2.1 or later.

Database specific 
{
    "cwe_ids":  [
        "CWE-1321",
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:34:14Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / merge

Package

Name
merge
View open source insights on deps.dev
Purl
pkg:npm/merge

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-f9cm-qmx5-m98h/GHSA-f9cm-qmx5-m98h.json"