Prototype Pollution

Vulnerability

The deep-get-set package (all versions) is vulnerable to Prototype Pollution via the deep function [1][2]. The deep function allows setting and getting values on objects using dot-notation strings. This vulnerability derives from an incomplete fix of CVE-2020-7715 [1].

Exploitation

An attacker can provide a crafted path like __proto__ or constructor.prototype to pollute the object prototype [2]. This can be achieved without authentication if the application processes user-supplied path strings [2].

Impact

Successful exploitation can lead to prototype pollution, potentially resulting in remote code execution, denial of service, or property injection that alters application behavior [2].

Mitigation

As of the available references, no patch has been released. The package repository appears to be archived [3]. Users should consider avoiding the use of deep-get-set or implementing strict input sanitization and validation for path strings.