Executive brief
deep-override is a JavaScript library used for deep object merging and property overriding. A prototype pollution vulnerability in versions 1.0.0–1.0.1 allows attackers to inject malicious properties into object prototypes, potentially causing denial of service or remote code execution by corrupting the runtime behavior of applications using this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the deep-override library's object merging logic. The vulnerable code does not sanitize or block assignment to special properties such as __proto__, constructor, and prototype. An attacker can craft a malicious input object containing these properties, which, when processed by the library's override function, pollutes the prototype chain and allows modification of inherited properties across all objects in the application. This is a network-accessible vulnerability requiring no authentication or user interaction. The fix (version 1.0.2) adds checks to reject these reserved property names before processing them.
Affected products
- <UNKNOWN> deep-override 1.0.0 through 1.0.1
Timeline
- 2021-05-17: disclosed
- 2021-05-17: patched: Fixed in version 1.0.2