Executive brief
The @alexbinary/object-deep-assign library is an npm package that recursively merges JavaScript objects, similar to Object.assign() but for nested structures. The library fails to sanitize input before copying properties, allowing an attacker to inject malicious code into the shared Object.prototype. This could lead to widespread application instability, data corruption, or code execution if exploited in production systems.
Technical details
The vulnerability is a classic prototype pollution flaw in the deepAssign module's extend() method (/src/index.js). The function recursively copies properties from a source object to a destination object without filtering dangerous keys like __proto__ or constructor.prototype. An attacker can craft a JSON payload containing __proto__ with malicious properties, which then get copied to the shared Object.prototype affecting all objects in the application. The attack requires no authentication and can be triggered by any code path that passes untrusted data to the extend() method. No patch has been released; the maintainer recommends users implement input sanitization to block __proto__ and constructor.prototype strings.
Affected products
- alexbinary @alexbinary/object-deep-assign through 1.0.11
Timeline
- 2024-06-17: disclosed: Vulnerability published via GHSA-4xg3-7w7q-856q
- 2024-06-17: other: CVE-2024-36582 assigned