PT-2018-16144 · Npm · Assign-Deep

Holyvier · Published 2018-06-07 · Updated 2023-02-28 · CVE-2018-3720

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions assign-deep versions prior to 0.4.7

Description The issue allows a malicious user to modify the prototype of Object via proto, causing the addition or modification of an existing property that will exist on all objects. This is achieved through prototype pollution via merging functions.

Recommendations Update to version 0.4.7 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-471

Related Identifiers

CVE-2018-3720

GHSA-XCVV-84J5-JW9H

Affected Products

Assign-Deep

References · 7

• 🔥 https://hackerone.com/reports/310707 · Exploit
• https://github.com/jonschlinkert/assign-deep/commit/19953a8c089b0328c470acaaaf6accdfcb34da11 · Patch
• https://osv.dev/vulnerability/CVE-2018-3720 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3720 · Security Note
• https://osv.dev/vulnerability/GHSA-xcvv-84j5-jw9h · Vendor Advisory
• https://github.com/advisories/GHSA-xcvv-84j5-jw9h · Note
• https://npmjs.com/advisories/579 · Note