Prototype Pollution in Clever Underscore.deep
CVE-2022-31106
Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to `deepFromFlat`, which would pollute any future Objects created. Any users that have `deepFromFlat` or `deepPick` (due to its dependency on `deepFromFlat`) in their code should upgrade to version 0.5.3 as soon as possible. Users unable to upgrade may mitigate this issue by modifying `deepFromFlat` to prevent specific keywords which will prevent this from happening.
Vulnerability class: Mass Assignment
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.011 (63.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 63.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.011 · change: +0.000
Affected products
- Clever Underscore.deep — versions < 0.5.3
Weakness classification (CWE)
References
- github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xm (Exploit, Patch, Third Party Advisory, Issue Tracking)
- github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8e… (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-31106?
- CVE-2022-31106 is a high-severity vulnerability in Clever Underscore.deep, classified under Improperly Controlled Modification of Dynamically-Determined Object Attributes. CVSS score: 8.3/10. Published 2022-06-28.
- How severe is CVE-2022-31106?
- High severity. CVSS v3 base score is 8.3 out of 10.