Exploitation Summary
EIP tracks 3 public exploits for CVE-2026-25047. PoCs published by banyamer, XiaomingX, mbanyamer.
AI-analyzed exploit summary This Python script demonstrates a prototype pollution vulnerability in the 'deephas' npm package (versions <= 1.0.7) by exploiting unsafe recursive property assignment. It includes two proof-of-concept exploits that pollute Object.prototype via constructor.prototype and __proto__ paths, leading to potential RCE, DoS, or security bypass.
Description
deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.
Exploits (3)
This Python script demonstrates a prototype pollution vulnerability in the 'deephas' npm package (versions <= 1.0.7) by exploiting unsafe recursive property assignment. It includes two proof-of-concept exploits that pollute Object.prototype via constructor.prototype and __proto__ paths, leading to potential RCE, DoS, or security bypass.
This repository contains a functional Python-based PoC demonstrating prototype pollution in the 'deephas' npm package (versions <= 1.0.7). The exploit leverages unsafe recursive property assignment to pollute Object.prototype via constructor.prototype and __proto__ paths, potentially leading to RCE or DoS.
This repository contains a functional Python-based PoC demonstrating prototype pollution in the 'deephas' npm package (versions <= 1.0.7), leading to arbitrary code execution or DoS via unsafe recursive property assignment.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H