Executive brief
defaults-deep is a utility library used to merge configuration objects in JavaScript applications. A prototype pollution vulnerability allows attackers to modify properties on the base Object prototype, potentially affecting all objects created in the application and leading to unauthorized code execution or logic bypass.
Technical details
The vulnerability is a prototype pollution flaw (CWE-345, CWE-400) in all versions of defaults-deep up to 0.2.4. When processing specially crafted input objects, the library fails to properly validate property names during the merge operation, allowing an attacker to inject or modify properties on the Object.prototype. This is a network-reachable vulnerability with no authentication required if the application accepts untrusted input and passes it to defaults-deep. An attacker can achieve arbitrary property injection on all JavaScript objects in the application's runtime context. No patch has been released; the recommendation is to use an alternative library.
Affected products
- npm defaults-deep all versions up to 0.2.4
Timeline
- 2019-02-07: disclosed