Listen to this Post
The vulnerability resides in the `deepobj` function, which splits a dot‑delimited `path` string into segments and traverses an object, creating missing intermediate objects. Until version 1.0.2, the function did not validate any path segments, allowing reserved keywords such as __proto__, constructor, and `prototype` to be used as segments.
If an attacker supplied a path like "__proto__.polluted", the library would:
1. Split the path into `[“__proto__”, “polluted”]`.
- Access the `__proto__` property of the current object, which returns the object’s prototype.
- Set a property named `polluted` on that prototype.
Because the prototype is shared by all objects in the JavaScript environment, this modifies the behaviour of every object that inherits fromObject.prototype.
The same effect can be achieved with paths like `”constructor.prototype.polluted”` or"constructor.constructor.prototype.polluted". The library trusted any segment as a plain property name, making it trivial to pollute the global prototype chain.
The following table shows the vulnerable version range and the fix:
| Affected versions | Fixed version | Patch date |
|||-|
| ≤ 1.0.2 | 1.0.3 | 2026‑05‑09 |
The patch (commit 425f0a0) introduced an explicit denylist – `[‘__proto__’, ‘constructor’, ‘prototype’]` – and throws an `Error` when any segment matches.
DailyCVE form:
Platform: `npm package`
Version: `≤1.0.2`
Vulnerability: `prototype pollution`
Severity: `high`
Date: `2026‑05‑14`
Prediction: `2026‑05‑09`
What Undercode Say:
Check affected versions npm list @ranfdev/deepobj | grep -E "@[0-9]+.[0-9]+.[0-9]+" Scan for unsafe property paths grep -rn "<strong>proto__|constructor|prototype" --include=".js" .
// Verify prototype pollution (vulnerable version 1.0.2)
const deepobj = require('@ranfdev/deepobj');
deepobj((obj, p) => (obj[bash] = 'polluted'), {}, '__proto</strong>.test');
console.log({}.test); // "polluted" – prototype modified!
Exploit:
const deepobj = require('@ranfdev/deepobj');
// Pollute Object.prototype with a malicious method
deepobj((obj, p) => (obj[bash] = () => console.log('Hijacked')), {}, '<strong>proto</strong>.toString');
// Every object’s toString is now replaced
console.log({}.toString()); // "Hijacked"
Protection from this CVE:
- Update to `@ranfdev/[email protected]` or later.
- If updating is impossible, sanitize all user‑supplied path strings by rejecting any occurrence of
'__proto__','constructor', or'prototype'. - Use `Object.create(null)` for internal data containers to eliminate the prototype chain.
Impact:
Successful exploitation allows an attacker to modify the global Object.prototype, affecting every object in the application. This can lead to unexpected behaviour, denial of service, or in some cases remote code execution if the polluted property is later used in a security‑sensitive context (e.g., command execution, authentication bypass).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
