CVE-2022-25907

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1321

Affected software

Vendor	Product	Versions
n/a	ts-deepmerge	>= unspecified, < 2.0.2

References

https://github.com/voodoocreation/ts-deepmerge/commit/9be5148773343c57be9de39728d6ead18eddf10bPatch, Third Party Advisory
https://github.com/voodoocreation/ts-deepmerge/releases/tag/2.0.2Release Notes, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-2959975Exploit, Patch, Third Party Advisory
https://github.com/voodoocreation/ts-deepmerge/commit/9be5148773343c57be9de39728d6ead18eddf10bPatch, Third Party Advisory
https://github.com/voodoocreation/ts-deepmerge/releases/tag/2.0.2Release Notes, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-2959975Exploit, Patch, Third Party Advisory

Timeline

Published: Aug 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-259089.8All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input CVE-2022-25917.5A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reb CVE-2022-259129.8The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it CVE-2022-259149.8The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, CVE-2022-259158.8Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, CVE-2022-259167.8Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.sca CVE-2022-259174.4Uncaught exception in the firmware for some Intel(R) Server Board M50CYP Family before version R01.01.0005 may allow a privileged user to po CVE-2022-259187.5The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in CVE-2022-25926.5A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 pr CVE-2022-259219.8All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function c CVE-2022-259229.1Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 CVE-2022-259239.8Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper u