Prototype Pollution in deep.assign

CRITICO 9.8CVE-2021-40663 · GHSA-3829-mgmw-jcg4 · Published 30/06/2022 · updated 17/06/2026

In breve

CVE-2021-40663 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda deep.assign (deep.assign project), deep.assign.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.8%, superiore al 78.5% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
deep.assign deep.assign_project	`= 0.0.0`	No fix yet
deep.assign npm	`= 0.0.0-alpha.0`	No fix yet

deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

NVD description

deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

Running one of these products? Scan your site to see whether it exposes a vulnerable version.