CVE-2024-39008: Javascript Prototype Pollution Recursive Deep Merge
Recursive deep-merge iterates source-object keys with `for...in` and assigns to `base[key]` by recursing into `base[key]` itself (`base[key] = merge(base[key], value)`) without filtering the dangerous keys `__proto__`, `constructor`, or `prototype`. If any source object is derived from attacker-controlled input (e.g., JSON.parse of a request body), reading `
JSgreprules fetch cve-2024-39008-javascript-prototype-pollution-recursive-deep-merge --engine opengrepDescription
Recursive deep-merge iterates source-object keys with `for...in` and assigns to `base[key]` by recursing into `base[key]` itself (`base[key] = merge(base[key], value)`) without filtering the dangerous keys `__proto__`, `constructor`, or `prototype`. If any source object is derived from attacker-controlled input (e.g., JSON.parse of a request body), reading `
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.