High severity8.3NVD Advisory· Published Jun 28, 2022· Updated Jun 17, 2026
CVE-2022-31106
CVE-2022-31106
Description
Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of underscore.deep prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to deepFromFlat, which would pollute any future Objects created. Any users that have deepFromFlat or deepPick (due to its dependency on deepFromFlat) in their code should upgrade to version 0.5.3 as soon as possible. Users unable to upgrade may mitigate this issue by modifying deepFromFlat to prevent specific keywords which will prevent this from happening.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:clever:underscore.deep:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:clever:underscore.deep:*:*:*:*:*:node.js:*:*range: <0.5.3
- (no CPE)range: < 0.5.3
- Range: <0.5.3
Patches
Vulnerability mechanics
References
2- github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8ef7nvdPatchThird Party Advisory
- github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xmnvdExploitIssue TrackingPatchThird Party Advisory
News mentions
0No linked articles in our index yet.