ranfdev/deepobj · Security
@ranfdev/deepobj has a Prototype Pollution vulnerability
- GHSA ID
- GHSA-x7q7-fchv-8h2j
- CVE ID
- CVE-2026-46509
- Severity
- high
- Published
- Updated
- CVSS
- 8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- CVSS v3
- 8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Description
Impact
Prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input.
CWEs
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')