CVE-2018-3722: hackerone merge-deep node module

Vulnerability summary

CVE-2018-3722 is a high (CVSS 8.8) vulnerability in hackerone merge-deep node module. EPSS estimates a 2.00% chance of exploitation in the next 30 days, higher than 80.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-06-2018
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

• CWE-471Modification of Assumed-Immutable Data (MAID)The product does not properly protect an assumed-immutable element from being modified by an attacker.