PT-2021-15506 · Unknown · Merge-Deep

Published 2021-07-28 · Updated 2021-08-10 · CVE-2021-23417

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions deepmergefn versions all

Description The issue concerns Prototype Pollution via the deepMerge function. This affects all versions of the package, allowing for potential manipulation of the prototype chain.

Recommendations For all versions, consider disabling the deepMerge function as a temporary workaround until a patch is available. Restrict the use of the deepMerge function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-23417

GHSA-VJ72-MWRJ-M2XQ

Affected Products

Merge-Deep

References · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-DEEPMERGEFN-1310984 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-23417 · Security Note
• https://osv.dev/vulnerability/GHSA-vj72-mwrj-m2xq · Vendor Advisory
• https://github.com/jesusgm/deepmergefn/blob/master/index.js#23L6 · Note
• https://github.com/jesusgm/deepmergefn/blob/master/index.js%23L6 · Note
• https://github.com/jesusgm/deepmergefn · Note
• https://t.me/cibsecurity/26559 · Telegram Post