The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Jul 3, 2018 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-nodemon | Feb 24, 2021 | Jul 3, 2018 |
| Debian | — | Upgrade node-deep-extend | Jul 30, 2024 | Jul 3, 2018 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-docsNo solution existsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-nodemon | Feb 24, 2021 | Jul 3, 2018 |
| Rocky_linux | — | — | Aug 15, 2024 | Jul 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub