Executive brief
deeps is a JavaScript utility library for manipulating deeply nested objects. A prototype pollution vulnerability in its set function allows an attacker to inject malicious properties into the JavaScript Object prototype, potentially causing application crashes, bypassing security checks, or executing arbitrary code depending on how the application uses object properties.
Technical details
The deeps library versions up to 1.4.5 are vulnerable to prototype pollution via unsafe property definition by path in the set function. An attacker can pass a path containing __proto__ (e.g., '__proto__.polluted') to set arbitrary properties on Object.prototype, which are then inherited by all JavaScript objects. This is a client-side vulnerability affecting any application using deeps to process untrusted input. The impact ranges from denial of service (by corrupting built-in methods like toString), to property injection attacks (e.g., bypassing isAdmin checks), to remote code execution if the application evaluates polluted properties. No patched version is currently available; remediation requires upgrading to an alternative library or implementing input validation.
Affected products
- deeps deeps up to 1.4.5
Timeline
- 2020-08-14: disclosed
- 2021-05-06: advisory