UBUNTU-CVE-2018-3750

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2018-3750
Published: 03 Jul 2018, 21:29
Last modified:24 Oct 2025, 04:46

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
3.0 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

03 Jul 2018, 21:29
Published
Vulnerability first disclosed
24 Oct 2025, 04:46
Last Modified
Vulnerability information updated

Description

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

CVSS Metrics

  • v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Systems

  • ubuntu•node-deep-extend

    all

References (6)