Description
deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | deeply | All versions prior to version 3.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | deeply | < 3.1.0 | 3.1.0 | GHSA-8j4w-5fw4-rm27 |