Description
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | assign-deep | All versions prior to 0.4.8 and version 1.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | assign-deep | < 0.4.8 | 0.4.8 | GHSA-66rh-8fw6-59q6 |
| npm | assign-deep | >= 1.0.0, < 1.0.1 | 1.0.1 | GHSA-66rh-8fw6-59q6 |