CVE-2022-31106

Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to `deepFromFlat`, which would pollute any future Objects created. Any users that have `deepFromFlat` or `deepPick` (due to its dependency on `deepFromFlat`) in their code should upgrade to version 0.5.3 as soon as possible. Users unable to upgrade may mitigate this issue by modifying `deepFromFlat` to prevent specific keywords which will prevent this from happening.

• CWE-915
• CWE-1321
• CWE-1321

• https://github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8ef7Patch, Third Party Advisory
• https://github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xmExploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8ef7Patch, Third Party Advisory
• https://github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xmExploit, Issue Tracking, Patch, Third Party Advisory

Published

Jun 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31100rulex is a new, portable, regular expression language. When …6.5
• CVE-2022-31101prestashop/blockwishlist is a prestashop extension which add…8.8
• CVE-2022-31102Argo CD is a declarative, GitOps continuous delivery tool fo…6.1
• CVE-2022-31103lettersanitizer is a DOM-based HTML email sanitizer for in-b…7.5
• CVE-2022-31104Wasmtime is a standalone runtime for WebAssembly. In affecte…5.6
• CVE-2022-31105Argo CD is a declarative, GitOps continuous delivery tool fo…9.6
• CVE-2022-31107Grafana is an open-source platform for monitoring and observ…7.5
• CVE-2022-31108Mermaid is a JavaScript based diagramming and charting tool …6.1
• CVE-2022-31109laminas-diactoros is a PHP package containing implementation…6.1
• CVE-2022-3111An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31110RSSHub is an open source, extensible RSS feed generator. In …7.5
• CVE-2022-31111Frontier is Substrate's Ethereum compatibility layer. In aff…5.3