Advisory Weakness Curation

assign-deep Vulnerable to Prototype Pollution Versions of `assign-deep` prior to 1.0.1 and 0.4.8 are vulnerable to Prototype Pollution. The `assign` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. ## Recommendation Upgrade to versions 1.0.1, 0.4.8, or later.

Improper Input Validation assign-deep is vulnerable to Prototype Pollution. The function `assign-deep` could be tricked into adding or modifying properties of `Object.prototype` using either a constructor or a `_proto_` payload.