Executive brief
ts-deepmerge is a popular TypeScript/JavaScript library used to merge objects deeply. Versions before 2.0.2 are vulnerable to prototype pollution, which allows attackers to inject malicious properties into JavaScript objects. This can compromise application functionality, bypass security checks, or enable arbitrary code execution depending on how the library is used.
Technical details
The vulnerability is a prototype pollution flaw in the merge function, caused by missing input sanitization. The vulnerability has a CVSS score of 9.8 (critical) with network attack vector and no authentication required. An attacker can craft malicious input containing prototype chain paths (e.g., "__proto__" or "constructor.prototype") to inject properties into Object.prototype or other constructors, affecting all objects in the application. This is a well-known class of JavaScript runtime vulnerabilities. The fix is available in version 2.0.2 and later.
Affected products
- voodoocreation ts-deepmerge before 2.0.2
Timeline
- 2022-08-10: disclosed
- 2022-08-10: patched: Version 2.0.2 released with fix