CVE-2022-31106

🗓️ 28 Jun 2022 17:30:14Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 57 Views

Underscore.deep prior to version 0.5.3 allows prototype pollution via crafted payloads to `deepFromFlat`. Upgrade to 0.5.3 or mitigate by modifying `deepFromFlat`

Reporter	Title	Published	Views	Family All 11
Huntr	the function deepFromFlat of underscore.deep is vulnerable to prototype pollution	2 Feb 202211:59	–	huntr
Circl	CVE-2022-31106	28 Jun 202222:42	–	circl
CNNVD	Underscore.deep 安全漏洞	28 Jun 202200:00	–	cnnvd
Cvelist	CVE-2022-31106 Prototype Pollution in underscore.deep	28 Jun 202217:30	–	cvelist
EUVD	EUVD-2022-52749	3 Oct 202520:07	–	euvd
NVD	CVE-2022-31106	28 Jun 202218:15	–	nvd
OSV	CVE-2022-31106 Prototype Pollution in underscore.deep	28 Jun 202217:30	–	osv
Prion	Code injection	28 Jun 202218:15	–	prion
RedhatCVE	CVE-2022-31106	9 Jan 202608:42	–	redhatcve
Veracode	Prototype Pollution	29 Jun 202211:14	–	veracode

NVD

Vulners

Node

clever underscore.deepRange<0.5.3node.js

[
  {
    "product": "underscore.deep",
    "vendor": "Clever",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.5.3"
      }
    ]
  }
]

Source	Link
github	www.github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xm
github	www.github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8ef7