CVE-2026-25047
Published: 29 January 2026
Summary
CVE-2026-25047 is a critical-severity Prototype Pollution (CWE-1321) vulnerability in Sharpred Deephas. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 49.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25047 is a prototype pollution vulnerability in version 1.0.7 of the deephas npm package, which provides a function to test for the existence of a nested object key and optionally return that key. The flaw allows an attacker to modify the behavior of global objects by polluting prototypes, as tracked under CWE-1321. This issue affects applications using deephas 1.0.7 and was assigned a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. By crafting malicious input to the deepHas function, the attacker can inject properties into Object.prototype or other prototypes, altering global object behavior across the application. This could lead to high-impact consequences, including arbitrary code execution, denial of service, or unauthorized data access and modification, due to the high scope change.
The vulnerability was fixed in deephas version 1.0.8, as detailed in the GitHub security advisory (GHSA-2733-6c58-pf27) and the patching commit (8097fafd3776c613d8066546653e0d2c7b5fc465). Security practitioners should update to version 1.0.8 or later and audit dependencies using tools like npm audit to identify and remediate affected packages.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4946
Vulnerability details
deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This…
more
issue was fixed in version 1.0.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution vulnerability exploited by low-privileged local attacker enables arbitrary code execution and high-impact effects, directly facilitating Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching of the prototype pollution flaw in deephas version 1.0.7 to the fixed 1.0.8 release.
Enables proactive identification of the CVE-2026-25047 vulnerability in deephas dependencies via automated scanning tools like npm audit.
Mandates secure configuration settings that enforce use of only approved, non-vulnerable versions of npm packages like deephas.