CVE-2026-25047 Details
Description
deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.
A prototype pollution vulnerability exists in the deepHas npm package, specifically in version 1.0.7. This vulnerability allows attackers to modify the behavior of global objects. The issue arises in the 'add()' and 'indexer()' functions within 'deepHas.js'. Although version 1.0.7 includes measures to prevent prototype pollution by checking property ownership and forbidden string usage, these checks can be bypassed. As a result, attackers can inject properties into Object.prototype, leading to potential security risks.
Users can upgrade to deepHas version 1.0.8, which addresses the prototype pollution vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sharpred deephas | 1.0.7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Jan 29, 2026 | New CVE Received | [email protected] |