Executive brief
deep-setter is a JavaScript library used to set nested properties on objects. A prototype pollution vulnerability in all versions allows attackers to add or modify properties that will exist on all objects in an application, potentially leading to unexpected behavior, data corruption, or code execution depending on how the application uses the affected objects.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the deep-setter npm package. The package fails to restrict modifications to an Object's prototype when setting nested properties, allowing an attacker to pollute the prototype chain. By providing specially crafted input, an attacker can add or modify properties on the Object prototype that will be inherited by all objects in the application. This requires the attacker to control the property path passed to the setter function. The severity depends on how the application uses the affected objects and what properties are modified.
Affected products
- npm deep-setter all versions
Timeline
- 2020-09-04: disclosed