CVE-2018-3722

merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Score

CVSS 3.0 8.8 High

Status

Modified - support@hackerone.com

Published

2018-06-07

Last modified

2024-09-17

Weaknesses

CWE-471

Affected products

• Merge-deep Node Module (Hackerone)
• Merge-deep (Merge-deep Project)

References

• https://github.com/jonschlinkert/merge-deep/commit/2c33634da7129a5aefcc262d2fec2e72224404e5
• https://hackerone.com/reports/310708