Executive brief
deep-get-set is a utility library for JavaScript that retrieves and sets nested properties in objects. A prototype pollution vulnerability allows attackers to modify the prototype chain of JavaScript objects, potentially compromising all objects created by the application and enabling arbitrary code execution or data manipulation across the entire application.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the main function of deep-get-set prior to version 1.1.1. The vulnerability allows an attacker to inject properties into Object.prototype by crafting malicious input that traverses the prototype chain during object property access or assignment. The attack is network-reachable with no authentication required if the vulnerable library is exposed through a web service. Successful exploitation enables arbitrary property injection across all JavaScript objects in the application runtime, potentially leading to privilege escalation, authentication bypass, or code execution. The vulnerability was patched in version 1.1.1.
Affected products
- npm deep-get-set <1.1.1
Timeline
- 2021-05-06: disclosed
- 2021-05-05: patched: Fixed in version 1.1.1