[immutable] Immutable is vulnerable to Prototype Pollution

**[immutable] Immutable is vulnerable to Prototype Pollution**

Impact What kind of vulnerability is it. A Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. Affected APIs API Notes mergeDeep(target, source) Iterates source keys via ObjectSeq, assigns merged[key] mergeDeepWith(merger, target, source) Same code path merge(target, source) Shallow variant, same assignment logic Map.toJS() object[k] = v in toObject() with no __proto__ guard Map.toObject() Same toObject() implementation Map.mergeDeep(source) When source is converted to plain object Patches Has the problem been patched. What versions should users upgrade to. major version patched version 3.x 3.8.3 4.x 4.3.7 5.x 5.1.5 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.