CVE-2021-40663

Description

deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

How to fix CVE-2021-40663

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• npm/deep.assign—no fix listed

Is CVE-2021-40663 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-40663
• PATCHgithub.com/janbialostok/deep-assign
• WEBgithub.com/janbialostok/deep-assign/issues/1
• WEBsecurity.netapp.com/advisory/ntap-20220826-0002
• WEB