CVE-2018-3750: Input Validation
Node.js deep-extend module could provide weaker than expected security, caused by a flaw in the Utilities function. A remote attacker could exploit this vulnerability to launch further attacks on the system.
Other sources
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
— MITRE
Versions of deep-extend before 0.5.1 are vulnerable to prototype pollution.
Recommendation
Update to version 0.5.1 or later.
— GitHub
Versions of deep-extend before 0.5.1 are vulnerable to prototype pollution. Under certain circumstances an attacker can add or modify properties that will exist on all objects.
External References:
https://nodesecurity.io/advisories/612 https://hackerone.com/reports/311333
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-3750?
CVE-2018-3750 is a vulnerability in the deep-extend module of Node.js that could result in weaker than expected security.
How can an attacker exploit CVE-2018-3750?
An attacker can exploit CVE-2018-3750 by tricking the utilities function in the deep-extend module into modifying the prototype of Object.
What is the severity of CVE-2018-3750?
CVE-2018-3750 has a severity rating of 9.8 (critical).
Which versions of deep-extend are affected by CVE-2018-3750?
All versions <= 0.5.0 of the deep-extend module are affected by CVE-2018-3750.
How do I fix CVE-2018-3750?
To fix CVE-2018-3750, update to version 0.5.1 of the deep-extend module.