Zag 安全漏洞

Zag is a framework open-sourced by Chakra. A security vulnerability exists in Zag version v0.50.0, which stems from the lib.deepMerge function containing a prototype contamination vulnerability...

CVE-2024-57085

A prototype pollution in the function deepMerge of @stryker-mutator/util v8.6.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

StrykerJS 安全漏洞

StrykerJS is a JavaScript library open-sourced by Stryker Mutator. A security vulnerability exists in StrykerJS version v8.6.0, which stems from the deepMerge function containing a prototype contamination vulnerability...

PT-2025-5759 · Unknown · @Stryker-Mutator/Util

Name of the Vulnerable Software and Affected Versions: @stryker-mutator/util version 8.6.0 Description: A prototype pollution in the deepMerge function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For @stryker-mutator/util version 8.6.0,...

Prototype Pollution

@75lb/deep-merge is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of deepMerge methods in lodash to merge objects, which can allow attackers to execute arbitrary code, cause a Denial of Service DoS...

Prototype Pollution

@antfu/utils is vulnerable to Prototype Pollution. The vulnerability exists due lack of sanization in the deepMerge function of object.js which allows an attacker to inject and modify malicious properties such as proto, resulting in prototype pollution...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js object-extended module code execution (ID221418)

Summary Potential vulnerabilities in Node.js object-extended module which is caused by a prototype pollution flaw in the deepMerge function.ID221418 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability...

Prototype Pollution

ts-deepmerge is vulnerable to pollution prototype. The vulnerability exists because of missing sanitization of the merge parameters in 'src/index.test.ts', allowing an attacker to inject malicious characteristics to add new values to a javascript application object prototype,overwriting or...

@alloyify/anvil (>=1.1.2, <=1.1.4), @alloyify/devkit (>=1.1.2, <=1.1.4) +12 more potentially affected by CVE-2022-25907 via ts-deepmerge (2.0.1)

ts-deepmerge NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ts-deepmerge and may be impacted: - @alloyify/anvil =1.1.2, =1.1.2, =1.1.2, =1.1.2, =0.0.0-canary-20220330074435, =0.0.0-canary-20220330074435, =5.0.24, =11.1.27, =4.0.22,...

GHSA-7QQQ-GH2F-WQ76 ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution

The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the merge function...

ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution

The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the merge function...

CVE-2022-25907

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...

CVE-2022-25907 Prototype Pollution

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...

CVE-2022-25907

CVE-2022-25907 affects the npm package ts-deepmerge prior to 2.0.2 and is caused by missing sanitization in the merge function, enabling prototype pollution. The vulnerability is described across multiple sources as allowing modification/ contamination of Object.prototype, with potential impact o...

CVE-2022-25907 Prototype Pollution

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...

CVE-2022-25907

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...

CVE-2022-25907

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...

PT-2022-17598 · Unknown · Ts-Deepmerge

Name of the Vulnerable Software and Affected Versions: ts-deepmerge versions prior to 2.0.2 Description: The issue is related to Prototype Pollution due to missing sanitization of the merge function. This allows for potential manipulation of the prototype, leading to various security issues...

CVE-2022-25907: Improperly Controlled Modification of Object Prototype Attributes

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...

deepmerge-ts 安全漏洞

deepmerge-ts is an npm package. It is used to deep merge 2 or more objects with respect to type information. A security vulnerability exists in versions of deepmerge-ts prior to 2.0.2, which stems from the lack of handling of merge functions and is susceptible to prototype contamination...