https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 18:25:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267055 EUVD-2026-267055 https://cve.radiocsirt.org/vuln/euvd-2026-267055 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25047 <p>deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.</p> <p>deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25047 https://cve.radiocsirt.org/vuln/ghsa-2733-6c58-pf27 <p><strong>Affected:</strong> npm: deephas</p> <p>### Summary A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.</p> <p>### Details The vulnerability resides in the `add()` function and `indexer()` function implemented within `deepHas.js`. Although version 1.0.7 attempts to prevent prototype pollution by checking property ownership (e.g., using Object.hasOwnProperty) and by checking against forbidden string usage (using String.prototype.indexOf), this check can be bypassed as shown in the PoC</p> <p>By doing so, an attacker can inject properties into Object.prototype through a payload such as constructor.prototype.polluted or __proto__.polluted resulting in prototype pollution.</p> <p>This issue affects all JavaScript runtimes that rely on npm packages (including Node.js, Deno, and Bun) and is independent of the operating system.</p> <p>### PoC #### Steps to reproduce 1. Install version 1.0.7 of `deephas` using npm install 2. Run one of the following code snippets:</p> <p>```javascript //PoC 1 Object.prototype.hasOwnProperty = () =&gt; true; console.log({}.polluted); const dh = require(&#39;deephas&#39;); let obj = {}; dh.set(obj, &#39;constructor.prototype.polluted&#39;, &#39;yes&#39;); console.log(&#39;{ &#39; + obj.polluted + &#39;, &#39; + &#39;yes&#39; + &#39; }&#39;); // prints yes =&gt; the patch is bypassed and prototype pollution occurred ``` OR</p> <p>```javascript //PoC 2 String.prototype.indexOf = () =&gt; -1; console.log({}.polluted); const dh = require(&#39;deephas&#39;); let obj = {};…</p> <p><strong>Affected:</strong> npm: deephas</p> <p>### Summary A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.</p> <p>### Details The vulnerability resides in the `add()` function and `indexer()` function implemented within `deepHas.js`. Although version 1.0.7 attempts to prevent prototype pollution by checking property ownership (e.g., using Object.hasOwnProperty) and by checking against forbidden string usage (using String.prototype.indexOf), this check can be bypassed as shown in the PoC</p> <p>By doing so, an attacker can inject properties into Object.prototype through a payload such as constructor.prototype.polluted or __proto__.polluted resulting in prototype pollution.</p> <p>This issue affects all JavaScript runtimes that rely on npm packages (including Node.js, Deno, and Bun) and is independent of the operating system.</p> <p>### PoC #### Steps to reproduce 1. Install version 1.0.7 of `deephas` using npm install 2. Run one of the following code snippets:</p> <p>```javascript //PoC 1 Object.prototype.hasOwnProperty = () =&gt; true; console.log({}.polluted); const dh = require(&#39;deephas&#39;); let obj = {}; dh.set(obj, &#39;constructor.prototype.polluted&#39;, &#39;yes&#39;); console.log(&#39;{ &#39; + obj.polluted + &#39;, &#39; + &#39;yes&#39; + &#39; }&#39;); // prints yes =&gt; the patch is bypassed and prototype pollution occurred ``` OR</p> <p>```javascript //PoC 2 String.prototype.indexOf = () =&gt; -1; console.log({}.polluted); const dh = require(&#39;deephas&#39;); let obj = {};…</p> https://cve.radiocsirt.org/vuln/ghsa-2733-6c58-pf27