https://vulnerability.circl.lu/sightings/feed 2026-08-01T19:44:31.035674+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a64e1f62-1130-4412-a46c-1085be73fe60/export 2026-08-01T19:44:31.060521+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a64e1f62-1130-4412-a46c-1085be73fe60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54737", "type": "seen", "source": "https://gist.github.com/alon710/3afa9bbe175e1dfd1649cd2081ad6eb5", "content": "# CVE-2026-54737: CVE-2026-54737: Prototype Pollution in @phun-ky/defaults-deep\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54737\n\n## Summary\nCVE-2026-54737 is a high-severity Prototype Pollution vulnerability in the @phun-ky/defaults-deep npm library prior to version 2.0.5. Due to unsafe recursive object merging, unauthenticated attackers can supply structured payloads that modify the properties of Object.prototype, compromising the runtime process state.\n\n## TL;DR\nA prototype pollution vulnerability in the recursive merging function of @phun-ky/defaults-deep versions prior to 2.0.5 allows remote attackers to execute arbitrary modification of Object.prototype attributes via crafted inputs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.3 (High)\n- **EPSS Status**: Not Registered\n- **Impact**: Prototype Pollution (Privilege Escalation, DoS, RCE)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js runtime environments using @phun-ky/defaults-deep dependency\n- **@phun-ky/defaults-deep**: < 2.0.5 (Fixed in: `2.0.5`)\n\n## Mitigation\n\n- Upgrade @phun-ky/defaults-deep to version 2.0.5 or above\n- Implement structural deep-sanitization recursive functions on all input middleware\n- Enforce strict prototype freezing at the initialization stage of Node.js services\n\n**Remediation Steps:**\n1. Run npm install @phun-ky/defaults-deep@2.0.5 inside project workspaces\n2. Incorporate input validation schemas such as AJV or Joi to reject properties named __proto__, constructor, and prototype\n3. Deploy custom Express body-parser middleware to strip dangerous keys before merging operations\n\n## References\n\n- [GitHub Security Advisory GHSA-mj3g-7xcc-x4vh](https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh)\n- [GitHub Pull Request #49](https://github.com/phun-ky/defaults-deep/pull/49)\n- [Fix Commit 807dba9](https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059)\n- [Release Tag v2.0.5](https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54737) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T18:32:14.083108Z"} 2026-07-31T18:32:14.083108+00:00