PT-2021-15527 · Npm · @Cookiex/Deep

Jayateertha Guruprasad · Published 2021-09-17 · Updated 2022-12-02 · CVE-2021-23442

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @cookiex/deep versions prior to 0.0.7

Description The issue allows pollution of the global proto object using the proto object. This can potentially lead to unintended behavior or security issues in applications that use the @cookiex/deep package.

Recommendations For versions prior to 0.0.7, update to version 0.0.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the proto object in your application to minimize the risk of exploitation.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-23442

GHSA-92V9-XH2Q-FQ9F

SNYK-JS-COOKIEXDEEP-1582793

Affected Products

@Cookiex/Deep

References · 9

• 🔥 https://snyk.io/vuln/SNYK-JS-COOKIEXDEEP-1582793 · Exploit
• https://github.com/tony-tsx/cookiex-deep/commit/b5bea2b7f34a5fa9abb4446cbd038ecdbcd09c88 · Patch
• https://github.com/tony-tsx/cookiex-deep/issues/1 · Patch
• https://osv.dev/vulnerability/CVE-2021-23442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23442 · Security Note
• https://osv.dev/vulnerability/GHSA-92v9-xh2q-fq9f · Vendor Advisory
• https://github.com/tony-tsx/cookiex-deep · Note
• https://t.me/cvenotify/21078 · Telegram Post
• https://t.me/cvenotify/21576 · Telegram Post