PT-2026-5362 · Npm · Deephas

Kevgeoleo + 2 · Publicado 2026-01-29 · Atualizado 2026-01-30 · CVE-2026-25047

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Crítica

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions deephas version 1.0.7 deephas versions prior to 1.0.8

Description A prototype pollution issue exists in the deephas npm package. This allows an attacker to modify global object behavior by injecting properties into Object.prototype. The issue resides in the add() function and indexer() function within deepHas.js. The vulnerability can be bypassed by manipulating Object.prototype.hasOwnProperty or String.prototype.indexOf. Exploitation can lead to authentication bypass, denial of service, and potentially remote code execution if polluted properties are passed to vulnerable sinks.

Recommendations deephas versions prior to 1.0.8 should be updated to version 1.0.8 or later.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2026-25047

GHSA-2733-6C58-PF27

Produtos afetados

Deephas

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25047.json · Exploit
• https://github.com/sharpred/deepHas/security/advisories/GHSA-2733-6c58-pf27 · Aviso do Fabricante
• https://github.com/sharpred/deepHas · Nota
• https://github.com/sharpred/deepHas/commit/8097fafd3776c613d8066546653e0d2c7b5fc465 · Correção
• https://twitter.com/CVEnew/status/2017000653327892866 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-2733-6c58-pf27 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25047 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2017073051989402083 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2017247700438114806 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2016993871700361676 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25047 · Aviso do Fabricante