https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 23:41:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-24956 EUVD-2026-24956 https://cve.radiocsirt.org/vuln/euvd-2026-24956 https://cve.radiocsirt.org/vuln/fkie_cve-2021-25944 <p>Prototype pollution vulnerability in &#39;deep-defaults&#39; versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.</p> <p>Prototype pollution vulnerability in &#39;deep-defaults&#39; versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-25944 https://cve.radiocsirt.org/vuln/ghsa-h6xg-rg33-9mf4 <p><strong>Affected:</strong> npm: deep-defaults</p> <p>### Overview Prototype pollution vulnerability in &#39;deep-defaults&#39; versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.</p> <p>### Details The NPM module `deep-defaults` can be abused by Prototype Pollution vulnerability since the function `_deepDefaults()` does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.</p> <p>### PoC The `_deepDefaults ()` function accepts `dest`, `src` as arguments. Due to the absence of validation on the values passed into the `src` argument, an attacker can supply a malicious value by adjusting the value to include the `__proto__` property. Since there is no validation before assigning the property to check whether the assigned argument is the Object&#39;s own property or not, the property `polluted` will be directly be assigned to the new object thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the valued would be substituted as &#34;Yes! Its Polluted&#34; as it had been polluted.</p> <p>```js var deepDefaults = require(&#34;deep-defaults&#34;) var malicious_payload = &#39;{&#34;__proto__&#34;:{&#34;polluted&#34;:&#34;Yes! Its Polluted&#34;}}&#39;; var obj ={}; console.log(&#34;Before : &#34; + {}.polluted); deepDefaults(obj, JSON.parse(malicious_payload)); console.log(&#34;After : &#34; + {}.polluted); ```</p> <p><strong>Affected:</strong> npm: deep-defaults</p> <p>### Overview Prototype pollution vulnerability in &#39;deep-defaults&#39; versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.</p> <p>### Details The NPM module `deep-defaults` can be abused by Prototype Pollution vulnerability since the function `_deepDefaults()` does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.</p> <p>### PoC The `_deepDefaults ()` function accepts `dest`, `src` as arguments. Due to the absence of validation on the values passed into the `src` argument, an attacker can supply a malicious value by adjusting the value to include the `__proto__` property. Since there is no validation before assigning the property to check whether the assigned argument is the Object&#39;s own property or not, the property `polluted` will be directly be assigned to the new object thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the valued would be substituted as &#34;Yes! Its Polluted&#34; as it had been polluted.</p> <p>```js var deepDefaults = require(&#34;deep-defaults&#34;) var malicious_payload = &#39;{&#34;__proto__&#34;:{&#34;polluted&#34;:&#34;Yes! Its Polluted&#34;}}&#39;; var obj ={}; console.log(&#34;Before : &#34; + {}.polluted); deepDefaults(obj, JSON.parse(malicious_payload)); console.log(&#34;After : &#34; + {}.polluted); ```</p> https://cve.radiocsirt.org/vuln/ghsa-h6xg-rg33-9mf4 https://cve.radiocsirt.org/vuln/gsd-2021-25944 gsd-2021-25944 https://cve.radiocsirt.org/vuln/gsd-2021-25944