High severity · published Jan 29, 2026
CVE-2026-25047
deepHas vulnerable to Prototype Pollution via constructor.prototype
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
deepHas · sharpred
< 1.0.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25047
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25047
Patch
https://github.com/sharpred/deepHas/commit/8097fafd3776c613d8066546653e0d2c7b5fc465
Exploit
https://github.com/sharpred/deepHas/security/advisories/GHSA-2733-6c58-pf27
More from deepHas
9.8
CVE-2020-28271
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution