CVE-2018-3749

The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

• CWE-20

• https://hackerone.com/reports/310446Exploit, Issue Tracking, Third Party Advisory
• https://hackerone.com/reports/310446Exploit, Issue Tracking, Third Party Advisory

Published

Jul 3, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-3743Open redirect in hekto <=0.2.3 when target domain name is us…6.1
• CVE-2018-3744The html-pages node module contains a path traversal vulnera…9.8
• CVE-2018-3745atob 2.0.3 and earlier allocates uninitialized Buffers when …9.1
• CVE-2018-3746The pdfinfojs NPM module versions <= 0.3.6 has a command inj…9.8
• CVE-2018-3747The public node module versions <= 1.0.3 allows to embed HTM…
• CVE-2018-3748There is a Stored XSS vulnerability in the glance node modul…
• CVE-2018-3750The utilities function in all versions <= 0.5.0 of the deep-…
• CVE-2018-3751The utilities function in all versions <= 0.3.0 of the merge…
• CVE-2018-3752The utilities function in all versions <= 1.0.0 of the merge…
• CVE-2018-3753The utilities function in all versions <= 1.0.0 of the merge…
• CVE-2018-3754Node.js third-party module query-mysql versions 0.0.0, 0.0.1…
• CVE-2018-3755XSS in sexstatic <=0.6.2 causes HTML injection in directory …6.1