CVE-2018-3723

描述

Versions of `default-deep` before 0.2.4 are vulnerable to prototype pollution ## Recommendation Update to version 0.2.4 or later.

受影響套件(1)

• npm/defaults-deepfrom 0, < 0.2.4

CVSS 分數

參考連結(5)

• ADVISORYhttps://github.com/advisories/GHSA-cqp5-m4pq-gfgp
• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-3723
• WEBhttps://github.com/jonschlinkert/defaults-deep/commit/c873f341327ad885ff4d0f23b3d3bca31b0343e5
• WEBhttps://hackerone.com/reports/310514
• WEBhttps://www.npmjs.com/advisories/581