CVE-2026-93753 in deepmerge
요약
\~에 의해 MITRE • 2026. 09. 18.
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.