CVE-2026-25047

CVE-2026-25047 is a prototype pollution vulnerability in version 1.0.7 of the deephas npm package, which provides a function to test for the existence of a nested object key and optionally return that key. The flaw allows an attacker to modify the behavior of global objects by polluting prototypes, as tracked under CWE-1321. This issue affects applications using deephas 1.0.7 and was assigned a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. By crafting malicious input to the deepHas function, the attacker can inject properties into Object.prototype or other prototypes, altering global object behavior across the application. This could lead to high-impact consequences, including arbitrary code execution, denial of service, or unauthorized data access and modification, due to the high scope change.

The vulnerability was fixed in deephas version 1.0.8, as detailed in the GitHub security advisory (GHSA-2733-6c58-pf27) and the patching commit (8097fafd3776c613d8066546653e0d2c7b5fc465). Security practitioners should update to version 1.0.8 or later and audit dependencies using tools like npm audit to identify and remediate affected packages.