{"id":"CVE-2019-10750","aliases":["EUVD-2019-0628","GHSA-8j4w-5fw4-rm27"],"status":"published","title":"Prototype Pollution in deeply","description":"deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01691,"percentile":0.77239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2019-08-23T16:50:36Z","modified":"2026-06-17T02:11:35Z","fixes":[{"ecosystem":"npm","package":"deeply","fixed_in":["3.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"deeply","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0"}]}]},{"source":"osv","ecosystem":"npm","package":"deeply","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.1.0"}]}]}],"products":[{"vendor":"deeply_project","product":"deeply"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-DEEPLY-451026","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10750","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/1030","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8j4w-5fw4-rm27"}],"sources":{"cve":[{"id":"CVE-2019-10750","description":"deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.","status":"published","published":"2019-08-23T16:50:36Z","modified":"2024-08-04T22:32:01.588Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-0628","description":"deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.","status":"published","published":"2019-08-23T16:50:36Z","modified":"2024-08-04T22:32:01Z","updated_at":"2026-11-03T02:40:51.633398Z"}],"ghsa":[{"id":"GHSA-8j4w-5fw4-rm27","title":"Prototype Pollution in deeply","description":"Versions of `deeply` prior to 1.0.1 are vulnerable to Prototype Pollution. The package fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.\n\n\n\n\n## Recommendation\n\nUpgrade to version 3.1.0 or later.","status":"published","published":"2019-08-27T17:45:33Z","modified":"2023-01-09T05:01:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"nvd":[{"id":"CVE-2019-10750","description":"deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.","status":"published","published":"2019-08-23T17:15:13.48Z","modified":"2026-06-17T02:11:35.977Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:05:23.725587Z"}],"osv":[{"id":"GHSA-8j4w-5fw4-rm27","title":"Prototype Pollution in deeply","description":"Versions of `deeply` prior to 1.0.1 are vulnerable to Prototype Pollution. The package fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.\n\n\n\n\n## Recommendation\n\nUpgrade to version 3.1.0 or later.","status":"published","published":"2019-08-27T17:45:33Z","modified":"2026-03-13T22:11:04.436474Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:42.437513Z"}]}}