eslint-config-vascular (>=0.0.1, <=0.0.3), udger-updater-nodejs (>=1.0.0, <=1.0.2) potentially affected by CVE-2018-3722 via merge-deep (3.0.0)

merge-deep NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge-deep and may be impacted: - eslint-config-vascular =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2018-3722 Source advisory: OSV:GHSA-9G9W-HMVJ-5H57...

CVE-2018-3722

merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

CVE-2018-3722

The CVE-2018-3722 entry concerns the merge-deep npm module, specifically versions before 3.0.1. A MAID/prototype-pollution flaw via proto enables an attacker to modify the prototype of Object, potentially adding or altering properties that exist on all objects. This can lead to server instability...

CVE-2018-3722

merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...