Skip to content

fix(deepmerge): patch prototype pollution CVE-2026-93753 #3438

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
dreamwasp wants to merge 1 commit into
base: main
Choose a base branch
from
+30 −1
Draft

fix(deepmerge): patch prototype pollution CVE-2026-93753 #3438

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions .yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
diff --git a/dist/cjs.js b/dist/cjs.js
index 7c36cbdd06cc22c92d590be3f87a08a91ca06b40..a5bcd4c2e916e9791174bebda8658852688f59db 100644
--- a/dist/cjs.js
+++ b/dist/cjs.js
@@ -69,8 +69,14 @@ function propertyIsOnObject(object, property) {
}
}

+// Keys that can be used to reach up the prototype chain and pollute Object.prototype (CVE-2026-93753).
+var UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
+
// Protects from prototype poisoning and unexpected merging up the prototype chain.
function propertyIsUnsafe(target, key) {
+ if (UNSAFE_KEYS.indexOf(key) !== -1) {
+ return true
+ }
return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
&& !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain,
&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
3 changes: 3 additions & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,9 @@
"@types/react-test-renderer": "^18.2.0",
"@typescript-eslint/utils": "^8.57.0",
"axios": "1.14.0",
"deepmerge@npm:^4.0.0": "patch:deepmerge@npm%3A4.3.1#~/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch",
"deepmerge@npm:^4.2.2": "patch:deepmerge@npm%3A4.3.1#~/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch",
"deepmerge@npm:^4.3.1": "patch:deepmerge@npm%3A4.3.1#~/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch",
"error-ex": "1.3.4",
"react": "^19.0.0",
"react-dom": "^19.0.0"
Expand Down
9 changes: 8 additions & 1 deletion yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10990,13 +10990,20 @@ __metadata:
languageName: node
linkType: hard

"deepmerge@npm:^4.0.0, deepmerge@npm:^4.2.2, deepmerge@npm:^4.3.1":
"deepmerge@npm:4.3.1":
version: 4.3.1
resolution: "deepmerge@npm:4.3.1"
checksum: 10c0/e53481aaf1aa2c4082b5342be6b6d8ad9dfe387bc92ce197a66dea08bd4265904a087e75e464f14d1347cf2ac8afe1e4c16b266e0561cc5df29382d3c5f80044
languageName: node
linkType: hard

"deepmerge@patch:deepmerge@npm%3A4.3.1#~/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch":
version: 4.3.1
resolution: "deepmerge@patch:deepmerge@npm%3A4.3.1#~/.yarn/patches/deepmerge-npm-4.3.1-4f751a0844.patch::version=4.3.1&hash=488791"
checksum: 10c0/5863a8d426429f5c7a080d6fb5ba003c6bbe6945efe86fcc90f0f9dd4aa69eaf87d84daf853239c5bf88453cbdc8855152406e153bdec234f34d4d3f10c0ab0a
languageName: node
linkType: hard

"default-browser-id@npm:^5.0.0":
version: 5.0.0
resolution: "default-browser-id@npm:5.0.0"
Expand Down
Loading