Threats tagged 'ghsa-gcqx-w48m-w2h4'

deepmerge versions up to and including 4.3.1 contain a prototype pollution vulnerability in the mergeObject() function. This flaw allows attackers to inject malicious properties into the prototype of returned objects by supplying crafted source objects during merge operations. As a result, applications using deepmerge may inherit unintended prototype properties, potentially affecting application behavior.