PT-2021-15543 · Unknown · Merge-Deep

Yeting Li · Published 2021-12-10 · Updated 2021-12-16 · CVE-2021-23663

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions sey versions all

Description The issue concerns Prototype Pollution via the deepmerge() function. This affects all versions of the package, allowing for potential manipulation of the prototype chain.

Recommendations For all versions, consider disabling the deepmerge() function as a temporary workaround until a patch is available. Restrict access to the deepmerge() function to minimize the risk of exploitation.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-23663

GHSA-WJPC-CGVW-XX23

Affected Products

Merge-Deep

References · 5

• 🔥 https://snyk.io/vuln/SNYK-JS-SEY-1727592 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-23663 · Security Note
• https://osv.dev/vulnerability/GHSA-wjpc-cgvw-xx23 · Vendor Advisory
• https://github.com/eserozvataf/sey · Note
• https://t.me/cibsecurity/33762 · Telegram Post