Skip to content
OpenAdvisories
Critical · 9.8 CVE-2018-3749 EUVD-2022-5777GHSA-xg47-r67p-vhv5

Improper Input Validation in Deap

Published Jul 3, 2018 · Updated Sep 16, 2024 · Assigned by hackerone

Description

The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Affected packages

EcosystemPackageAffectedFixedRecord
npm deap < 1.0.1 1.0.1 GHSA-xg47-r67p-vhv5

References