Prototype Pollution in Clever Underscore.deep
CVE-2022-31106
Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to `deepFromFlat`, which would pollute any future Objects created. Any users that have `deepFromFlat` or `deepPick` (due to its dependency on `deepFromFlat`) in their code should upgrade to version 0.5.3 as soon as possible. Users unable to upgrade may mitigate this issue by modifying `deepFromFlat` to prevent specific keywords which will prevent this from happening.
Vulnerability class: Mass Assignment
EPSS: 0.010 (59.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L.
Affected products
- Clever Underscore.deep — versions < 0.5.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Third Party Advisory, Issue Tracking)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-31106?
- CVE-2022-31106 is a high-severity vulnerability in Clever Underscore.deep, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 8.3/10. Published 2022-06-28.
- How severe is CVE-2022-31106?
- High severity. CVSS v3 base score is 8.3 out of 10.