Executive brief
deep-object-diff is a popular JavaScript library used to compute and compare differences between objects in Node.js and browser applications. A prototype pollution vulnerability allows attackers to inject malicious properties into objects by manipulating the __proto__ key during comparison operations, potentially enabling code execution or unauthorized data modification across applications using this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in deep-object-diff versions before 1.1.9, where the library fails to properly validate incoming JSON keys during object comparison. An attacker can craft malicious input containing the __proto__ property to modify the prototype chain of objects, polluting the Object prototype. No authentication or user interaction is required; the attack is triggered by network-reachable comparison operations. An attacker can add or edit arbitrary properties on affected objects, potentially leading to privilege escalation, code injection, or denial of service depending on how the library is used. The fix was released in version 1.1.9.
Affected products
- deep-object-diff deep-object-diff before 1.1.9
Timeline
- 2022-10-05: disclosed
- 2022-11-04: advisory
- 2022-11-09: patched: Version 1.1.9 released with fix