-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| deep-defaults | npm | >= 1.0.0, <= 1.0.5 |
Miggo AIRoot Cause AnalysisThe vulnerability documentation explicitly identifies _deepDefaults as the vulnerable function. The function's implementation (visible in lib/index.js) shows it uses _.each to copy properties from src to dest without: 1) validating if the property key is proto or other sensitive prototype properties, 2) checking if properties belong to the object's own properties using hasOwnProperty or equivalent. This allows prototype pollution via malicious src input containing proto payloads, as demonstrated in the PoC. The confidence is high as the analysis matches both the vulnerability description and the actual code implementation.
JavaScriptJavaScriptOngoing coverage of React2Shell