CVE-2026-46509 — deepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVE-2026-46509

deepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') PUBLISHED

Description (CNA)

deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input. This vulnerability is fixed in 1.0.3.

Affected (CNA)

Vendor / product	Versions
ranfdev / deepobj	affected < 1.0.3

CWE

CWE-1321

References

https://github.com/ranfdev/deepobj/security/advisories/GHSA-x7q7-fchv-8h2j

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.