CVE-2024-36582

2024-06-1700:00:00

mitre

github.com

cve-2024-36582 prototype pollution module.deepassign

AI Score

7.1

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:alykoshin:mini-deep-assign:0.0.8:*:*:*:*:*:*:*"
    ],
    "vendor": "alykoshin",
    "product": "mini-deep-assign",
    "versions": [
      {
        "status": "affected",
        "version": "0.0.8"
      }
    ],
    "defaultStatus": "unknown"
  }
]