https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 04:10:56 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-54737 <p>@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.</p> <p>@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-54737 https://vulnerability.circl.lu/vuln/ghsa-mj3g-7xcc-x4vh <p><strong>Affected:</strong> npm: @phun-ky/defaults-deep</p> <p>### Impact</p> <p>A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.</p> <p>The library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process.</p> <p>Applications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.</p> <p>### Patches</p> <p>This issue has been fixed in version 2.0.5.</p> <p>Users should upgrade to version 2.0.5 or later.</p> <p>The fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.</p> <p>### Workarounds</p> <p>Users unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`.</p> <p>At a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:</p> <p>- `__proto__` - `constructor` - `prototype`</p> <p>Upgrading to a patched version remains the recommended mitigation.</p> <p><strong>Affected:</strong> npm: @phun-ky/defaults-deep</p> <p>### Impact</p> <p>A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.</p> <p>The library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process.</p> <p>Applications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.</p> <p>### Patches</p> <p>This issue has been fixed in version 2.0.5.</p> <p>Users should upgrade to version 2.0.5 or later.</p> <p>The fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.</p> <p>### Workarounds</p> <p>Users unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`.</p> <p>At a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:</p> <p>- `__proto__` - `constructor` - `prototype`</p> <p>Upgrading to a patched version remains the recommended mitigation.</p> https://vulnerability.circl.lu/vuln/ghsa-mj3g-7xcc-x4vh