| 标题 | cleverbrush @cleverbrush/deep (npm) <=4.4.0 Prototype Pollution |
|---|
| 描述 | A prototype pollution vulnerability exists in the exported deepExtend() function of the npm package @cleverbrush/deep up to and including version 4.4.0 (the current latest release; no fixed version exists). The recursive merge helper extendObject in libs/deep/src/deepExtend.ts iterates the source object's keys with Object.keys(o2) and applies no exclusion for the special keys __proto__, constructor, or prototype before writing or recursing. When one of the source arguments is an object built from attacker-controlled input (for example JSON.parse() of a request body, query, or stored config), an own enumerable '__proto__' data property causes the merge to resolve the receiver's '__proto__' to Object.prototype and recurse into it, then assign attacker-named keys directly onto Object.prototype. The result is global prototype pollution: every object in the realm subsequently inherits the injected property. (The constructor/prototype route does not apply because the receiver's constructor is a function; __proto__ is the working vector.)
Proof of concept (benign, local, Node v24, against the published 4.4.0 artifact): deepExtend({a:{}}, JSON.parse('{"a":{"__proto__":{"polluted":"pp"}}}')) sets ({}).polluted === 'pp' while the returned object has no own 'polluted' property, proving the value landed on Object.prototype.
Impact is context-dependent on the consuming application and ranges from denial of service to logic bypass and, with a secondary gadget, potential code execution. Exploitation requires a downstream consumer that passes attacker-influenced object data into deepExtend, so it is a library-level pollution primitive rather than a standalone unauthenticated exploit.
Suggested fix: skip __proto__/constructor/prototype keys in the merge loop, and use Object.hasOwn(o1, key) instead of Reflect.has(o1, key).
CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L (Base 6.5). CWE-1321.
Public reference (coordinated disclosure): https://github.com/cleverbrush/framework/issues/213
npm: https://www.npmjs.com/package/@cleverbrush/deep
Researcher: Mykhailo Kholiev. |
|---|
| 来源 | ⚠️ https://github.com/cleverbrush/framework/issues/213 |
|---|
| 用户 | Anonymous User |
|---|
| 提交 | 2026-07-11 13時13分 (1 月前) |
|---|
| 管理 | 2026-08-25 01時08分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 394866 [cleverbrush framework/deep 直到 4.4.0 deepExtend.ts deepExtend 远程代码执行] |
|---|
| 积分 | 20 |
|---|