Most recent entries from all

EUVD-2026-46975

2026-10-15T20:39:27.752999+00:00

EUVD-2026-46975

fkie_cve-2020-28276

2026-10-15T20:39:27.753046+00:00

Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.

GHSA-wgxm-rg53-h2c6 — Prototype pollution vulnerability in 'deep-set'

2026-10-15T20:39:27.753091+00:00

Affected: npm: deep-set

The NPM module 'deep-set' can be abused by Prototype Pollution vulnerability since the function `deepSet()` does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.

### PoC ```js var deepSet = require('deep-set') var obj = {'1':'2'} console.log(obj.isAdmin); deepSet(obj, '__proto__.isAdmin', 'true') console.log(obj.isAdmin); ```

gsd-2020-28276

2026-10-15T20:39:27.753135+00:00

gsd-2020-28276