GHSA-737v-mqg7-c878
High · 7.5CVSS
7.5
EPSS
—
Published
Apr 4, 2026
CISA due date
—
The record
defu: Prototype pollution via `__proto__` key in defaults argument
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | defu | 0 | 6.1.5 |
| Chainguard | jitsucom-jitsu-console | 0 | 2.11.0-r19 |
| Chainguard | renovate | 0 | 43.104.7-r1 |
| Wolfi | jitsucom-jitsu-console | 0 | 2.11.0-r19 |
| Wolfi | renovate | 0 | 43.104.7-r1 |
Related vulnerabilities
- CVE-2026-35209 defu is software that allows uers to assign default properties recursively. Same vulnerability
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects jitsucom-jitsu-console
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects jitsucom-jitsu-console
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects jitsucom-jitsu-console
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects jitsucom-jitsu-console
- GHSA-c7w3-x93f-qmm8 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter Also affects jitsucom-jitsu-console
- CVE-2026-32887 Effect is a TypeScript framework that consists of several packages that work together to… Also affects jitsucom-jitsu-console
- GHSA-38f7-945m-qr2g Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under… Also affects jitsucom-jitsu-console