-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ts-deepmerge | npm | < 2.0.2 | 2.0.2 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from the merge function in src/index.ts handling 'proto' keys without sanitization. The GitHub commit shows the fix added a PROTECTED_KEYS check to explicitly skip 'proto' during merging. The added test case demonstrates that prior to this fix, merging objects with 'proto' properties would pollute the prototype. This directly matches CWE-1321 (Prototype Pollution) and the advisory's description of missing sanitization in the merge function.
Ongoing coverage of React2Shell