{"id":"CVE-2026-54737","sourceIdentifier":"security-advisories@github.com","published":"2026-07-31T18:17:17.330","lastModified":"2026-10-23T23:10:00.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5."},{"lang":"es","value":"@phun-ky/defaults-deep es una biblioteca similar a lodash defaultsDeep con preservación de arrays y sin dependencia de lodash. Antes de la versión 2.0.5, defaultsDeep() fusiona recursivamente objetos proporcionados por el usuario sin filtrar proto, constructor y prototype, permitiendo que las propiedades se escriban en Object.prototype. Este problema está solucionado en la versión 2.0.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"phun-ky","product":"defaults-deep","versions":[{"version":"< 2.0.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-31T18:53:15.831395Z","id":"CVE-2026-54737","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059","source":"security-advisories@github.com"},{"url":"https://github.com/phun-ky/defaults-deep/pull/49","source":"security-advisories@github.com"},{"url":"https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5","source":"security-advisories@github.com"},{"url":"https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh","source":"security-advisories@github.com"}]}