High
Security advisory
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-7748
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 11:32 UTC · Revision 1
Source evidence
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
osv:CVE-2020-7748
Complete source record
{
"id": "4dbd052fefd65b08efcc1254c72faa52c6d73a7887ae7645b350529476a0e328",
"url": "https://osv.dev/vulnerability/CVE-2020-7748",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-7748",
"summary": "This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.",
"evidence": "osv:CVE-2020-7748",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-7748",
"aliases": [
"CVE-2020-7748",
"GHSA-77xq-cpvg-7xm2",
"SNYK-JS-TSEDCORE-1019382"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/tsedio/tsed",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d27b6d2b2e8b0e01c6022c3f343a93d1d5dc23d8"
},
{
"fixed": "1395773ddac35926cf058fc6da9fb8e82266761b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ts.ed_project:ts.ed:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.65.7"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "1395773ddac35926cf058fc6da9fb8e82266761b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v5.65.6",
"v5.65.5",
"v5.65.4",
"v5.65.3",
"v5.65.2",
"v5.65.1",
"v5.65.0",
"v5.64.2",
"v5.64.1",
"v5.64.0",
"v5.63.1",
"v5.63.0",
"v5.62.6",
"v5.62.5",
"v5.62.4",
"v5.62.3",
"v5.62.2",
"v5.62.1",
"v5.62.0",
"v5.61.4",
"v5.61.3",
"v5.61.2",
"v5.61.1",
"v5.61.0",
"v5.60.7",
"v5.60.6",
"v5.60.5",
"v5.60.4",
"v5.60.3",
"v5.60.2",
"v5.60.1",
"v5.60.0",
"v5.59.4",
"v5.59.3",
"v5.59.2",
"v5.59.1",
"v5.59.0",
"v5.58.2",
"v5.58.1",
"v5.58.0",
"v5.57.7",
"v5.57.6",
"v5.57.5",
"v5.57.4",
"v5.57.3",
"v5.57.2",
"v5.57.1",
"v5.57.0",
"v5.56.0",
"v5.55.0",
"v5.54.6",
"v5.54.5",
"v5.54.3",
"v5.54.4",
"v5.54.2",
"v5.54.1",
"v5.54.0",
"v5.53.1",
"v5.53.0",
"v5.52.3",
"v5.52.2",
"v5.52.1",
"v5.52.0",
"v5.51.0",
"v5.50.0",
"v5.49.2",
"v5.49.1",
"v5.49.0",
"v5.48.0",
"v5.47.1",
"v5.47.0",
"v5.46.0",
"v5.45.4",
"v5.45.3",
"v5.45.2",
"v5.45.1",
"v5.45.0",
"v5.44.17",
"v5.44.16",
"v5.44.15",
"v5.44.14",
"v5.44.13",
"v5.44.12",
"v5.44.11",
"v5.44.10",
"v5.44.9",
"v5.44.8",
"v5.44.7",
"v5.44.6",
"v5.44.5",
"v5.44.4",
"v5.44.3",
"v5.44.2",
"v5.44.1",
"v5.44.0",
"v5.43.1",
"v5.43.0",
"v5.42.3",
"v5.42.2",
"v5.42.1",
"v5.42.0",
"v5.41.2",
"v5.41.1",
"v5.41.0",
"v5.40.1",
"v5.40.0",
"v5.39.3",
"v5.39.2",
"v5.39.1",
"v5.39.0",
"v5.38.7",
"v5.38.6",
"v5.38.5",
"v5.38.4",
"v5.38.3",
"v5.38.2",
"v5.38.1",
"v5.38.0",
"v5.37.1",
"v5.37.0",
"v5.36.2",
"v5.36.1",
"v5.36.0",
"v5.35.3",
"v5.35.2",
"v5.35.1",
"v5.35.0",
"v5.34.10",
"v5.34.9",
"v5.34.8",
"v5.34.7",
"v5.34.6",
"v5.34.5",
"v5.34.4",
"v5.34.3",
"v5.34.2",
"v5.34.1",
"v5.34.0",
"v5.33.5",
"v5.33.4",
"v5.33.3",
"v5.33.2",
"v5.33.1",
"v5.33.0",
"v5.32.2",
"v5.32.1",
"v5.32.0",
"v5.31.4",
"v5.31.3",
"v5.31.2",
"v5.31.1",
"v5.31.0",
"v5.30.0",
"v5.29.0",
"v5.28.3",
"v5.28.2",
"v5.28.1",
"v5.28.0",
"v5.27.5",
"v5.27.4",
"v5.27.3",
"v5.27.2",
"v5.27.1",
"v5.27.0",
"v5.26.0",
"v5.25.1",
"v5.25.0",
"v5.24.2",
"v5.24.1",
"v5.24.0",
"v5.23.0",
"v5.22.0",
"v5.21.1",
"v5.21.0",
"v5.20.1",
"v5.20.0",
"v5.19.1",
"v5.19.0",
"v5.18.2",
"v5.18.1",
"v4.34.3",
"v5.18.0",
"v5.17.1",
"v5.17.0",
"v5.16.0",
"v5.15.0",
"v5.14.1",
"v5.14.0",
"v5.13.0",
"v5.12.1",
"v5.12.0",
"v5.11.0",
"v5.10.0",
"v5.9.0",
"v5.8.0",
"v5.7.1",
"v5.7.0",
"v5.6.1",
"v5.6.0",
"v5.5.0",
"v5.4.0",
"v5.3.0",
"v5.2.5",
"v5.2.4",
"v5.2.3",
"v5.2.2",
"v5.2.1",
"v5.2.0",
"v5.1.3",
"v5.1.2",
"v5.1.1",
"v5.1.0",
"v5.0.9",
"v5.0.8",
"v5.0.7",
"v5.0.6",
"v5.0.5",
"v5.0.4",
"v5.0.3",
"v5.0.2",
"v5.0.1",
"v5.0.0",
"v4.34.2",
"v4.34.1",
"v4.34.0",
"v4.33.1",
"v4.33.0",
"v4.32.4",
"v4.32.3",
"v4.32.2",
"v4.32.1",
"v4.32.0",
"v4.31.13",
"v4.31.12",
"v4.31.11",
"v4.31.10",
"v4.31.9",
"v4.31.8",
"v4.31.7",
"v4.31.6",
"v4.31.5",
"v4.31.4",
"v4.31.3",
"v4.31.2",
"v4.31.1",
"v4.31.0",
"v4.30.6",
"v4.30.5",
"v4.30.4",
"v4.30.3",
"v4.30.2",
"v4.30.1",
"v4.30.0",
"v4.29.1",
"v4.29.0",
"v4.28.0",
"v4.27.3",
"v4.27.2",
"v4.27.1",
"v4.27.0",
"v4.26.4",
"v4.26.3",
"v4.26.2",
"v4.26.1",
"v4.26.0",
"v4.25.0",
"v4.24.0",
"v4.23.2",
"v4.23.1",
"v4.23.0",
"v4.22.1",
"v4.22.0",
"v4.21.0",
"v4.20.3",
"v4.20.2",
"v4.20.1",
"v4.20.0",
"v4.19.1",
"v4.19.0",
"v4.18.0",
"v4.17.7",
"v4.17.6",
"v4.17.5",
"v4.17.4",
"v4.17.3",
"v4.17.2",
"v4.17.1",
"v4.17.0",
"v4.16.0",
"v4.15.2",
"v4.15.1",
"v4.15.0",
"v4.14.4",
"v4.14.3",
"v4.14.2",
"v4.14.1",
"v4.14.0",
"v4.13.8",
"v4.13.7",
"v4.13.6",
"v4.13.5",
"v4.13.4",
"v4.13.3",
"v4.13.2",
"v4.13.1",
"v4.13.0",
"v4.12.4",
"v4.12.3",
"v4.12.2",
"v4.12.1",
"v4.12.0",
"v4.11.0",
"v4.10.5",
"v4.10.4",
"v4.10.3",
"v4.10.2",
"v4.10.1",
"v4.10.0",
"v4.9.1",
"v4.9.0",
"v4.8.1",
"v4.8.0",
"v4.7.2",
"v4.7.1",
"v4.7.0",
"v4.6.0",
"v4.5.4",
"v4.5.3",
"v4.5.2",
"v4.5.1",
"v4.5.0",
"v4.4.2",
"v4.4.1",
"v4.4.0",
"v4.3.0",
"v4.2.0",
"v4.1.0",
"v4.0.7",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v4.0.1",
"v4.0.0",
"v3.10.2",
"v3.10.1",
"v3.10.0",
"v3.9.2",
"v3.9.1",
"v3.9.0",
"v3.8.1",
"v3.8.0",
"v3.7.0",
"v3.6.0",
"v3.5.0",
"v3.4.2",
"v3.4.1",
"v3.4.0",
"v3.3.0",
"v3.2.0",
"v3.1.0",
"v3.0.1",
"v3.0.0",
"v2.20.0",
"v2.19.0",
"v2.18.2",
"v2.18.1",
"v2.18.0",
"v2.17.1",
"v2.17.0",
"v2.16.3",
"v2.16.2",
"v2.16.1",
"v2.16.0",
"v2.15.4",
"v2.15.3",
"v2.15.2",
"v2.15.1",
"v2.15.0",
"v2.14.2",
"v2.14.1",
"v2.14.0",
"v2.13.0",
"v2.12.0",
"v2.11.0",
"v2.10.0",
"v2.9.2",
"v2.9.1",
"v2.9.0",
"v2.8.0",
"v2.7.2",
"v2.7.1",
"v2.7.0",
"v2.6.4",
"v2.6.3",
"v2.6.2",
"v2.6.1",
"v2.6.0",
"v2.5.0",
"v2.4.4",
"v2.4.3",
"v2.4.2",
"v2.4.1",
"v2.4.0",
"v2.3.9",
"v2.3.8",
"v2.3.7",
"v2.3.6",
"v2.3.5",
"v2.3.4",
"v2.3.3",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.0",
"v2.1.0",
"v2.0.15",
"v2.0.14",
"v2.0.13",
"v2.0.12",
"v2.0.11",
"v2.0.10",
"v2.0.9",
"v2.0.8",
"v2.0.7",
"v2.0.6",
"v2.0.5",
"v2.0.4",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v2.0.0-6",
"v2.0.0-5",
"v2.0.0-4",
"v2.0.0-3",
"v2.0.0-2",
"v1.4.13",
"v2.0.0-1",
"v1.4.12",
"v1.4.11",
"v1.4.10",
"v1.4.9",
"v1.4.8",
"v1.4.7",
"v1.4.6",
"v1.4.5",
"v1.4.4",
"v1.4.3",
"v1.4.2",
"v1.4.1",
"v1.4.0",
"v1.4.0-23",
"v1.4.0-22",
"v1.4.0-21",
"v1.4.0-20",
"v1.4.0-19",
"v1.4.0-18",
"v1.4.0-17",
"v1.4.0-16",
"v1.4.0-15",
"v1.4.0-14",
"v1.4.0-13",
"v1.4.0-12",
"v1.4.0-11",
"v1.4.0-10",
"v1.4.0-9",
"v1.4.0-8",
"v1.4.0-7",
"v1.4.0-6",
"v1.4.0-5",
"v1.4.0-4",
"v1.4.0-3",
"v1.4.0-2",
"v1.4.0-1",
"v1.4.0-0",
"v1.3.0",
"v1.3.0-10",
"v1.3.0-9",
"v1.3.0-8",
"v1.3.0-7",
"v1.3.0-6",
"v1.3.0-5",
"v1.3.0-4",
"v1.3.0-3",
"v1.2.6",
"v1.2.5",
"v1.2.4",
"v1.2.3",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.2.0-4",
"v1.2.0-3",
"v1.2.0-2",
"v1.2.0-1",
"v1.2.0-0",
"v1.1.0",
"v1.0.1",
"v1.0.0",
"v0.3.1",
"v0.3.0",
"v0.2.3",
"v0.2.2",
"v0.2.1",
"v0.2.0",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7748.json"
}
}
],
"modified": "2026-10-20T10:54:29.559220045Z",
"provider": "osv",
"references": [
"https://github.com/TypedProject/tsed/blob/production/packages/core/src/utils/deepExtends.ts%23L36",
"https://github.com/TypedProject/tsed/commit/1395773ddac35926cf058fc6da9fb8e82266761b",
"https://snyk.io/vuln/SNYK-JS-TSEDCORE-1019382"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-7748",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 385453,
"published_at": "2020-10-20T11:15:12.583+00:00"
}