ByteOS Network

CVE Vulnerability Details :

CVE-2026-46509

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-28 May, 2026 | 17:52

Updated At-28 May, 2026 | 17:52

▼CVE Numbering Authority (CNA)

deepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input. This vulnerability is fixed in 1.0.3.

Affected Products

Vendor

ranfdev

Product

deepobj

Versions

Affected

< 1.0.3

Problem Types

Type	CWE ID	Description
CWE	CWE-1321	CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Type: CWE

CWE ID: CWE-1321

Description: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Metrics

Version	Base score	Base severity	Vector
3.1	8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Version: 3.1

Base score: 8.2

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References

Hyperlink	Resource
https://github.com/ranfdev/deepobj/security/advisories/GHSA-x7q7-fchv-8h2j	x_refsource_CONFIRM

Hyperlink: https://github.com/ranfdev/deepobj/security/advisories/GHSA-x7q7-fchv-8h2j

Resource:

x_refsource_CONFIRM

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References