The ranfdev deepobj JavaScript library versions before 1.0.3 are vulnerable to prototype pollution (CWE-1321) when property paths include __proto__, constructor, or prototype. This allows attackers to modify object prototype attributes improperly, which can lead to elevated privileges or altered application behavior. The vulnerability is addressed in version 1.0.3 by preventing such property paths from being processed. The vulnerability has a CVSS 3.1 score of 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

Successful exploitation can lead to modification of object prototype attributes, potentially allowing attackers to alter application logic or escalate privileges within the affected environment. There is no confidentiality impact reported. The integrity impact is high, and availability impact is low. No known exploits in the wild have been reported.

Upgrade ranfdev deepobj to version 1.0.3 or later, where the prototype pollution vulnerability is fixed. Avoid exposing property paths containing __proto__, constructor, or prototype to untrusted user input. Patch status is not explicitly stated but the vulnerability is fixed in version 1.0.3, so updating to this version or newer is the recommended remediation.