Executive brief
deep-get-set is a JavaScript library that allows developers to get and set nested values in objects using dot-notation paths. The library is vulnerable to prototype pollution, which allows an attacker to modify the underlying prototype of JavaScript objects. An attacker can exploit this vulnerability to inject malicious properties that would affect all instances of affected objects, potentially leading to application denial of service or unexpected behavior across the application.
Technical details
The vulnerability is a prototype pollution flaw in the deep function of the deep-get-set library, arising from an incomplete fix of a prior prototype pollution issue (CVE-2020-7715). The root cause lies in insufficient validation when setting nested object properties via dot-notation paths, allowing an attacker to set properties on Object.prototype or other sensitive prototypes by using crafted path inputs. This is a network-reachable vulnerability with no authentication or user interaction required if the affected library is exposed through a network service. An attacker can pollute the prototype chain to cause denial of service or alter application behavior. All versions up to and including 1.1.1 are affected; users should upgrade to a patched version when available.
Affected products
- acstll deep-get-set up to 1.1.1
Timeline
- 2022-06-25: disclosed
- 2022-06-29: advisory: GitHub security review completed