The deepobj library versions before 1.0.3 are vulnerable to prototype pollution via property paths containing __proto__, constructor, or prototype. This allows an attacker to modify object prototype attributes improperly, potentially impacting the integrity of the application. The vulnerability is addressed in version 1.0.3, which prevents such property paths from being processed. The CVSS 3.1 score of 8.2 reflects a network attack vector with low complexity, no privileges, no user interaction, and high impact on integrity with low impact on availability.

An attacker can exploit this vulnerability to modify the prototype of JavaScript objects, leading to potential integrity violations in applications using vulnerable versions of deepobj. This could result in unexpected behavior or security bypasses in affected applications. There is no reported impact on confidentiality or availability beyond low impact on availability. No known exploits are currently reported in the wild.

Upgrade deepobj to version 1.0.3 or later, where this prototype pollution vulnerability is fixed. Since the vulnerability is resolved in this version, applying this update is the recommended remediation. Patch status is confirmed by the vendor advisory indicating the fix in 1.0.3. No additional mitigations are specified.