Executive brief
getsetdeep is a JavaScript library used for deep object property manipulation. A prototype pollution vulnerability in the setDeep() function allows attackers to modify object prototypes, potentially adding or changing properties that affect all objects in an application. This could lead to unexpected behavior, data corruption, or serve as a stepping stone for other attacks.
Technical details
The setDeep() function in all versions of getsetdeep fails to validate or restrict modifications to an Object's prototype chain. An attacker can exploit this prototype pollution vulnerability by crafting malicious input that targets prototype properties, allowing arbitrary addition or modification of properties on all objects. The vulnerability is exploitable if an application uses getsetdeep to set properties based on untrusted user input. No patch has been released; the advisory recommends switching to an alternative package until a fix is available.
Affected products
- getsetdeep getsetdeep all versions
Timeline
- 2020-09-04: disclosed