{"schema":"threatline.record/2","record":{"id":"CVE-2026-93753","aliases":["GHSA-gcqx-w48m-w2h4"],"summary":"deepmerge mergeObject() allows prototype poisoning of returned objects","details":"deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.","categories":["Libraries & packages"],"product":"deepmerge","vendor":"TehShrike","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-gcqx-w48m-w2h4","source_modified_at":"2026-10-27T21:34:58Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"ecosystem":"npm","name":"deepmerge"},"range":">= 4.2.0, <= 4.3.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93753","source_modified_at":"2026-09-24T14:23:12.090Z","fetched_at":"2026-10-28T01:10:53.534015Z","product":"deepmerge","vendor":"TehShrike","versions":[{"version":"0","status":"affected","versionType":"semver","lessThanOrEqual":"4.3.1"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-gcqx-w48m-w2h4","source_modified_at":"2026-10-27T21:45:04.256048049Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"name":"deepmerge","ecosystem":"npm","purl":"pkg:npm/deepmerge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.0"},{"last_affected":"4.3.1"}]}],"versions":[]}],"fixed_versions":[],"cvss":2.7,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00514,"percentile":0.43598,"score_date":"2026-10-27"},"published_at":"2026-09-18T17:51:37.794Z","modified_at":"2026-10-27T21:45:04.256048049Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-gcqx-w48m-w2h4","fetched_at":"2026-10-28T01:10:53.534015Z","source_modified_at":"2026-10-27T21:34:58Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-93753","fetched_at":"2026-10-28T01:10:53.534015Z","source_modified_at":"2026-09-24T14:23:12.090Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-gcqx-w48m-w2h4","fetched_at":"2026-10-28T01:10:53.534015Z","source_modified_at":"2026-10-27T21:45:04.256048049Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93753","fetched_at":"2026-10-28T01:10:53.534015Z","source_modified_at":"2026-10-27"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93753","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/TehShrike/deepmerge/issues/273","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-gcqx-w48m-w2h4","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/TehShrike/deepmerge","tags":["product"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-18T19:16:56.102337Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T21:45:04.256048049Z","content_hash":"f3e54a6b482c8cd3180a32ce423fe7001a093aad50dc2b7a2989a700983ac53c"}}