Unknown · @Intlify/Shared · CVE-2024-52810
**Name of the Vulnerable Software and Affected Versions**
@intlify/shared versions 10.0.4
**Description**
The issue is related to Prototype Pollution through the entry function(s) `lib.deepCopy`. An attacker can supply a payload with `Object.prototype` setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) as the minimum consequence. The consequences of this issue can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., `exec`, `eval`), it could enable an attacker to execute arbitrary commands within the application's context.
**Recommendations**
For @intlify/shared version 10.0.4, upgrade to version 10.0.5 to resolve the issue.
As a temporary workaround, consider restricting the use of the `lib.deepCopy` function until a patch is available.
Avoid using the `Object.prototype` setter in the affected `lib.deepCopy` function until the issue is resolved.