CVE-2022-41713 json
deep-object-diff 1.1.0 - Prototype Pollution
published 2022-11-03 4 y ago modified 2026-06-17 4 mo ago also GHSA-653v-rqx9-j85p , EUVD-2022-7249
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the '__proto__' property to be edited.
Patch / fix
- npm deep-object-diff 1.1.9
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.84% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- fluidattacks.com https://fluidattacks.com/advisories/heldens/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | deep-object-diff | >=1.1.6, <1.1.9 |
1.1.9 |
Affected products
- n/a deep-object-diff
Classification
- Weakness
-
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
References
-
github.com
/mattphillips/deep-object-diff/pull/87/commits/55f9c3c70cf0d54cb30291e949fb8682fa3c5d9f
web
-
github.com
/mattphillips/deep-object-diff/pull/87/commits/9576963b68b955e88610aa4f0c696a1aafc1119d
web
-
fluidattacks.com
/advisories/heldens/
exploit, third-party-advisory
-
github.com
/mattphillips/deep-object-diff
package, product
-
nvd.nist.gov
/vuln/detail/CVE-2022-41713
advisory
-
github.com
/mattphillips/deep-object-diff/issues/85
web
-
github.com
/mattphillips/deep-object-diff/issues/85#issuecomment-1312450353
web
-
fluidattacks.com
/advisories/heldens
web
Sources
- CVE List CVE-2022-41713
- GitHub Advisory GHSA-653v-rqx9-j85p
- NVD CVE-2022-41713
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.