Vulnerability-Lookup

CVE-2026-54737 (GCVE-0-2026-54737)

Vulnerability from cvelistv5 – Published: 2026-07-31 17:48 – Updated: 2026-07-31 19:00

Title

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

Summary

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/phun-ky/defaults-deep/security…	x_refsource_CONFIRM
https://github.com/phun-ky/defaults-deep/pull/49	x_refsource_MISC
https://github.com/phun-ky/defaults-deep/commit/8…	x_refsource_MISC
https://github.com/phun-ky/defaults-deep/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
phun-ky	defaults-deep	Affected: < 2.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54737",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T18:53:15.831395Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T19:00:41.074Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "defaults-deep",
          "vendor": "phun-ky",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T17:48:42.670Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh"
        },
        {
          "name": "https://github.com/phun-ky/defaults-deep/pull/49",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phun-ky/defaults-deep/pull/49"
        },
        {
          "name": "https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059"
        },
        {
          "name": "https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-mj3g-7xcc-x4vh",
        "discovery": "UNKNOWN"
      },
      "title": "@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54737",
    "datePublished": "2026-07-31T17:48:42.670Z",
    "dateReserved": "2026-06-15T23:07:33.233Z",
    "dateUpdated": "2026-07-31T19:00:41.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54737",
      "date": "2026-08-01",
      "epss": "0.00262",
      "percentile": "0.17913"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54737\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-31T18:17:17.330\",\"lastModified\":\"2026-07-31T19:17:10.957\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"phun-ky\",\"product\":\"defaults-deep\",\"versions\":[{\"version\":\"\u003c 2.0.5\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-31T18:53:15.831395Z\",\"id\":\"CVE-2026-54737\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1321\"}]}],\"references\":[{\"url\":\"https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/phun-ky/defaults-deep/pull/49\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54737\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-31T18:53:15.831395Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-31T18:53:24.009Z\"}}], \"cna\": {\"title\": \"@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging\", \"source\": {\"advisory\": \"GHSA-mj3g-7xcc-x4vh\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"phun-ky\", \"product\": \"defaults-deep\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.0.5\"}]}], \"references\": [{\"url\": \"https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh\", \"name\": \"https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/phun-ky/defaults-deep/pull/49\", \"name\": \"https://github.com/phun-ky/defaults-deep/pull/49\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059\", \"name\": \"https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5\", \"name\": \"https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1321\", \"description\": \"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-31T17:48:42.670Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54737\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-31T19:00:41.074Z\", \"dateReserved\": \"2026-06-15T23:07:33.233Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-31T17:48:42.670Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-MJ3G-7XCC-X4VH

Vulnerability from github – Published: 2026-07-31 17:49 – Updated: 2026-07-31 17:49

Summary

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

Details

Impact

A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.

The library recursively merged user-supplied objects without filtering unsafe property names such as __proto__, constructor, and prototype. An attacker able to supply crafted input could cause properties to be written to Object.prototype, resulting in prototype pollution affecting all objects within the running process.

Applications that pass untrusted input to defaultsDeep() may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.

Patches

This issue has been fixed in version 2.0.5.

Users should upgrade to version 2.0.5 or later.

The fix prevents unsafe prototype-related keys (__proto__, constructor, and prototype) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.

Workarounds

Users unable to upgrade should ensure that untrusted input is sanitized before being passed to defaultsDeep().

At a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:

__proto__
constructor
prototype

Upgrading to a patched version remains the recommended mitigation.

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@phun-ky/defaults-deep"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54737"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T17:49:08Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.\n\nThe library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process.\n\nApplications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.\n\n### Patches\n\nThis issue has been fixed in version 2.0.5.\n\nUsers should upgrade to version 2.0.5 or later.\n\nThe fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.\n\n### Workarounds\n\nUsers unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`.\n\nAt a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:\n\n- `__proto__`\n- `constructor`\n- `prototype`\n\nUpgrading to a patched version remains the recommended mitigation.",
  "id": "GHSA-mj3g-7xcc-x4vh",
  "modified": "2026-07-31T17:49:09Z",
  "published": "2026-07-31T17:49:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/pull/49"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phun-ky/defaults-deep"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted