Object Modification Vulnerability in deep-object-diff from Fluid Attacks

CVE-2022-41713

What is CVE-2022-41713?

The deep-object-diff application version 1.1.0 contains a vulnerability that allows external attackers to modify or add properties to objects. This is due to the application’s failure to adequately validate incoming JSON keys, enabling the manipulation of the 'proto' property. Attackers exploiting this flaw can potentially alter an object’s prototype, leading to unauthorized changes in application behavior or data integrity.

References