A critical prototype pollution vulnerability in the extend-deep library allows unauthenticated remote attackers to modify global object attributes, leading to potential remote code execution.

This vulnerability is a prototype pollution flaw (CWE-1321) occurring in the index.js file. An unauthenticated attacker can inject a malicious proto property during object merging, which allows for the uncontrolled modification of object prototype attributes throughout the application runtime.

Successful exploitation allows an attacker to manipulate the global state of the application, which may lead to unauthorized data access, security control bypass, or remote code execution. With a CVSS score of 7.3, this flaw represents a significant risk to application integrity and availability. Given that the project is no longer maintained, organizations relying on this package are at permanent risk of compromise.

Immediate Action: Since there is no official patch, the primary remediation is to remove the extend-deep dependency from the project and replace it with a secure, maintained alternative.

Proactive Monitoring: Review application logs for unusual object property modifications or attempts to pass unexpected JSON payloads containing proto keys to API endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) or input sanitization logic to inspect incoming JSON payloads and block requests containing the proto key before they reach the vulnerable merge function.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security research write-up referenced by the CVE.

Given the lack of active maintenance for the extend-deep library, patching is not a viable long-term strategy. Security teams must identify all instances of this dependency within their software supply chain and prioritize its removal. Failure to replace this package leaves the application permanently vulnerable to prototype pollution attacks that can be leveraged for full system compromise.