WS-2018-0091 Low Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

WS-2018-0091 - Low Severity Vulnerability

Vulnerable Library - deep-extend-0.4.1.tgz

Recursive object extending

path: /tmp/git/Hardware-con-Nodejs/node_modules/serialport/node_modules/node-pre-gyp/node_modules/rc/node_modules/deep-extend/package.json

Library home page: http://registry.npmjs.org/deep-extend/-/deep-extend-0.4.1.tgz

Dependency Hierarchy:

• serialport-4.0.7.tgz (Root Library)
  • node-pre-gyp-0.6.32.tgz
    • rc-1.1.6.tgz
      • ❌ deep-extend-0.4.1.tgz (Vulnerable Library)

Vulnerability Details

Versions of deep-extend before 0.5.1 are vulnerable to prototype pollution.

Publish Date: 2018-04-25

URL: WS-2018-0091

CVSS 2 Score Details (2.0)

Base Score Metrics not available

---

Step up your Open Source Security Game with WhiteSource here