CVE-2018-3722

Vulnerability

The merge-deep npm package before version 3.0.1 contains a prototype pollution vulnerability. The mergeDeep function does not filter out the __proto__ key, allowing a malicious JSON payload to modify the prototype of the global Object constructor [1][2]. This is a Modification of Assumed-Immutable Data (MAID) vulnerability [1].

Exploitation

An attacker can supply a crafted object literal containing a __proto__ property with arbitrary properties as the value. When merge-deep merges this object into another, it assigns those properties to Object.prototype, bypassing the hasOwn check on line 33 of index.js [3]. No special privileges are needed beyond the ability to supply the input to the mergeDepp function.

Impact

Successful exploitation enables a global prototype pollution: any property assigned via __proto__ becomes available on all JavaScript objects in the runtime [1][2]. This can lead to unexpected behavior, denial of service, or in some application contexts, privilege escalation, arbitrary code execution, or data corruption, depending on how the polluted property is used by the application.

Mitigation

Update to merge-deep version 3.0.1 or later, which includes a fix that explicitly checks for the __proto__ key and skips it during merging (commit 2c33634da7129a5aefcc262d2fec2e72224404e5) [3]. No workaround is available for vulnerable versions; the only safe mitigation is to upgrade.