Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:40737
HistoryMay 30, 2023 - 1:58 p.m.

Prototype Pollution

2023-05-3013:58:50
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
vulnerability
antfu/utils
prototype pollution
deepmerge function
object.js
injection
modification

0.002 Low

EPSS

Percentile

56.4%

@antfu/utils is vulnerable to Prototype Pollution. The vulnerability exists due lack of sanization in the deepMerge function of object.js which allows an attacker to inject and modify malicious properties such as __proto__, resulting in prototype pollution.

CPENameOperatorVersion
@antfu/utilsle0.7.2
@antfu/utilsle0.7.2

0.002 Low

EPSS

Percentile

56.4%