Executive brief
deephas is a popular JavaScript utility library for safely accessing and modifying properties in nested objects. A prototype pollution vulnerability in version 1.0.7 allows attackers who control input passed to the library to inject malicious properties into the global JavaScript object prototype, potentially compromising the behavior of all objects in the application. This can lead to authentication bypasses, denial of service, or remote code execution depending on how the polluted properties are used downstream.
Technical details
The vulnerability is a prototype pollution flaw residing in the add() and indexer() functions of deepHas.js. Although version 1.0.7 attempts mitigation via Object.hasOwnProperty checks and String.prototype.indexOf filtering, these checks can be bypassed by overriding the prototype methods themselves (e.g., setting Object.prototype.hasOwnProperty to always return true). An attacker providing input like "constructor.prototype.polluted" or "__proto__.polluted" to the dh.set() function can inject arbitrary properties into Object.prototype, affecting all objects globally. Attack vectors require only local access and no authentication, and downstream applications using this polluted data with dangerous sinks (eval, child_process, authentication logic) face severe risk. The patch is available in version 1.0.8.
Affected products
- sharpred deephas 1.0.7
Timeline
- 2026-01-29: disclosed: Vulnerability published on GitHub advisory database
- 2026-01-29: patched: Fix released in version 1.0.8