GHSA-MJ3G-7XCC-X4VH

Vulnerability from github – Published: 2026-07-31 17:49 – Updated: 2026-07-31 17:49
VLAI
Summary
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
Details

Impact

A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.

The library recursively merged user-supplied objects without filtering unsafe property names such as __proto__, constructor, and prototype. An attacker able to supply crafted input could cause properties to be written to Object.prototype, resulting in prototype pollution affecting all objects within the running process.

Applications that pass untrusted input to defaultsDeep() may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.

Patches

This issue has been fixed in version 2.0.5.

Users should upgrade to version 2.0.5 or later.

The fix prevents unsafe prototype-related keys (__proto__, constructor, and prototype) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.

Workarounds

Users unable to upgrade should ensure that untrusted input is sanitized before being passed to defaultsDeep().

At a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:

  • __proto__
  • constructor
  • prototype

Upgrading to a patched version remains the recommended mitigation.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@phun-ky/defaults-deep"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54737"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T17:49:08Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.\n\nThe library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process.\n\nApplications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.\n\n### Patches\n\nThis issue has been fixed in version 2.0.5.\n\nUsers should upgrade to version 2.0.5 or later.\n\nThe fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.\n\n### Workarounds\n\nUsers unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`.\n\nAt a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:\n\n- `__proto__`\n- `constructor`\n- `prototype`\n\nUpgrading to a patched version remains the recommended mitigation.",
  "id": "GHSA-mj3g-7xcc-x4vh",
  "modified": "2026-07-31T17:49:09Z",
  "published": "2026-07-31T17:49:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/pull/49"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phun-ky/defaults-deep"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.