| 제목 | cleverbrush @cleverbrush/deep (npm) <=4.4.0 Prototype Pollution |
|---|
| 설명 | A prototype pollution vulnerability exists in the exported deepExtend() function of the npm package @cleverbrush/deep up to and including version 4.4.0 (the current latest release; no fixed version exists). The recursive merge helper extendObject in libs/deep/src/deepExtend.ts iterates the source object's keys with Object.keys(o2) and applies no exclusion for the special keys __proto__, constructor, or prototype before writing or recursing. When one of the source arguments is an object built from attacker-controlled input (for example JSON.parse() of a request body, query, or stored config), an own enumerable '__proto__' data property causes the merge to resolve the receiver's '__proto__' to Object.prototype and recurse into it, then assign attacker-named keys directly onto Object.prototype. The result is global prototype pollution: every object in the realm subsequently inherits the injected property. (The constructor/prototype route does not apply because the receiver's constructor is a function; __proto__ is the working vector.)
Proof of concept (benign, local, Node v24, against the published 4.4.0 artifact): deepExtend({a:{}}, JSON.parse('{"a":{"__proto__":{"polluted":"pp"}}}')) sets ({}).polluted === 'pp' while the returned object has no own 'polluted' property, proving the value landed on Object.prototype.
Impact is context-dependent on the consuming application and ranges from denial of service to logic bypass and, with a secondary gadget, potential code execution. Exploitation requires a downstream consumer that passes attacker-influenced object data into deepExtend, so it is a library-level pollution primitive rather than a standalone unauthenticated exploit.
Suggested fix: skip __proto__/constructor/prototype keys in the merge loop, and use Object.hasOwn(o1, key) instead of Reflect.has(o1, key).
CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L (Base 6.5). CWE-1321.
Public reference (coordinated disclosure): https://github.com/cleverbrush/framework/issues/213
npm: https://www.npmjs.com/package/@cleverbrush/deep
Researcher: Mykhailo Kholiev. |
|---|
| 원천 | ⚠️ https://github.com/cleverbrush/framework/issues/213 |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 07. 11. PM 01:13 (1 월 ago) |
|---|
| 모더레이션 | 2026. 08. 25. AM 01:08 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 394866 [cleverbrush framework/deep 까지 4.4.0 deepExtend.ts deepExtend 원격 코드 실행] |
|---|
| 포인트들 | 20 |
|---|