PT-2019-12021 · Npm · Assign-Deep

Published 2019-08-20 · Updated 2022-12-02 · CVE-2019-10745

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions assign-deep versions prior to 0.4.8 assign-deep versions prior to 1.0.1

Description The issue allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. This is due to the assign function failing to validate which Object properties it updates. The function could be tricked into adding or modifying properties of Object.prototype using either a constructor or a proto payload.

Recommendations For versions prior to 0.4.8, upgrade to version 0.4.8 or later. For versions prior to 1.0.1, upgrade to version 1.0.1 or later.

Exploit

Fix

Prototype Pollution

RCE

Weakness Enumeration

CWE-1321

CWE-20

CWE-915

Related Identifiers

CVE-2019-10745

GHSA-66RH-8FW6-59Q6

SNYK-JS-ASSIGNDEEP-450211

Affected Products

Assign-Deep

References · 8

• 🔥 https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10745 · Security Note
• https://osv.dev/vulnerability/GHSA-66rh-8fw6-59q6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10745 · Vendor Advisory
• https://github.com/jonschlinkert/assign-deep/commit/8e3cc4a34246733672c71e96532105384937e56c · Note
• https://github.com/jonschlinkert/assign-deep/commit/90bf1c551d05940898168d04066bbf15060f50cc · Note
• https://github.com/jonschlinkert/assign-deep · Note
• https://npmjs.com/advisories/1014 · Note