CVE-2018-3720

Vulnerability

The assign-deep npm package before version 0.4.7 suffers from a prototype pollution vulnerability (MAID). The extend function does not check for the __proto__ key when copying properties from source objects, allowing an attacker to modify Object.prototype via a crafted input object [1][2]. This affects all versions prior to 0.4.7.

Exploitation

An attacker can supply an object containing a __proto__ property with arbitrary nested properties. When assign-deep merges this object into a target, it assigns the nested properties directly onto Object.prototype [2]. No special privileges or authentication are required; the attack is triggered by the library consuming user-controlled objects.

Impact

Successful exploitation allows the attacker to add or modify any property on Object.prototype, thereby affecting all objects in the runtime. This can lead to unexpected behavior, denial of service, property injection, and in some contexts, arbitrary code execution if the application later reads or executes the injected properties [1][2].

Mitigation

The vulnerability is fixed in assign-deep version 0.4.7, released on 2018-07-26 [2]. The fix explicitly excludes the __proto__ key during property assignment [3]. Users should upgrade to version 0.4.7 or later. No known workaround exists for earlier versions.