CyberRota Analysis
AI-GeneratedThe defaultsDeep() function in the @phun-ky/defaults-deep library prior to version 2.0.5 is vulnerable to prototype pollution, allowing attackers to manipulate Object.prototype by merging unfiltered user-supplied objects. This can lead to unexpected behavior in applications using the library, potentially compromising application integrity and security. Developers and organizations utilizing this library should prioritize upgrading to version 2.0.5 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.