VulnerabilityModified
CVE-2021-26707
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it.
CRITICAL 9.8EPSS 1.90%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.90% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1321
- Affected
- merge-deep project/merge-deep · netapp/e-series performance analyzer
- Source
- cve@mitre.org
References
- https://github.com/jonschlinkert/merge-deep/commit/11e5dd56de8a6aed0b1ed022089dbce6968d82a5Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210716-0008/Third Party Advisory
- https://securitylab.github.com/advisories/GHSL-2020-160-merge-deep/Third Party Advisory
- https://www.npmjs.com/package/merge-deepProduct, Third Party Advisory
- https://github.com/jonschlinkert/merge-deep/commit/11e5dd56de8a6aed0b1ed022089dbce6968d82a5Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210716-0008/Third Party Advisory
- https://securitylab.github.com/advisories/GHSL-2020-160-merge-deep/Third Party Advisory
- https://www.npmjs.com/package/merge-deepProduct, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.