Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

assign-deep Node Module Can Be Compromised by Malicious Users

CVE-2018-3720 · published 8 years ago
Summary

A security issue exists in the assign-deep Node module for versions prior to 0.4.7. This issue allows an attacker to manipulate the behavior of the Object prototype, which can lead to unpredictable results and potentially allow malicious code to be executed on any object. To fix this, update to version 0.4.7 or later.

What to do
  • Update jonschlinkert assign-deep to version 0.4.7.
  • Update assign-deep_project assign-deep to version 0.4.7 or later.
Affected software
Ecosystem VendorProductAffected versions
npm jonschlinkert assign-deep < 0.4.7
Fix: upgrade to 0.4.7
– assign-deep_project assign-deep < 0.4.7
cpe:2.3:a:assign-deep_project:assign-deep:*:*:*:*:*:node.js:*:*
Original advisory text
assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, cau...
assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-471Modification of Assumed-Immutable Data (MAID)
CWE-1321Prototype Pollution
Timeline
Published7 Jun 2018
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-xcvv-84j5-jw9h · GHSA
CVE-2018-3720 · NVD
Track software like this
Free during beta