PT-2022-16888 · Unknown · Ts-Deepmerge

Rebeccastevens · Published 2022-03-31 · Updated 2022-04-11 · CVE-2022-24802

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions deepmerge-ts versions prior to 4.0.2

Description The issue is related to Prototype Pollution in the deepmerge-ts library, which provides functionality for deep merging of JavaScript objects. This pollution occurs via the file deepmerge.ts, specifically in the function defaultMergeRecords(). There are no known workarounds for this issue.

Recommendations For versions prior to 4.0.2, update to version 4.0.2 to resolve the issue. As a temporary workaround, consider restricting the use of the defaultMergeRecords() function until the update is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2022-24802

GHSA-R9W3-G83Q-M6HQ

Affected Products

Ts-Deepmerge

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24802.json · Exploit
• https://github.com/RebeccaStevens/deepmerge-ts/commit/d637db7e4fb2bfb113cb4bc1c85a125936d7081b · Patch
• https://github.com/RebeccaStevens/deepmerge-ts/commit/b39f1a93d9e1c3541bd2fe159fd696a16dbe1c72 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24802 · Security Note
• https://osv.dev/vulnerability/GHSA-r9w3-g83q-m6hq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24802 · Vendor Advisory
• https://github.com/RebeccaStevens/deepmerge-ts · Note
• https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-r9w3-g83q-m6hq · Note
• https://t.me/cvenotify/28254 · Telegram Post