{"id":"CVE-2020-7765","details":"This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.","aliases":["GHSA-fpm5-vv97-jfwg"],"modified":"2026-07-09T01:25:45.314496Z","published":"2020-11-16T12:15:14.320Z","references":[{"type":"FIX","url":"https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada"},{"type":"FIX","url":"https://github.com/firebase/firebase-js-sdk/pull/4001"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/firebase/firebase-js-sdk","events":[{"introduced":"0"},{"fixed":"fc358f6e4650545428fbab889ae12ddfe0c9c204"},{"fixed":"9cf727fcc3d049551b16ae0698ac33dc2fe45ada"}],"database_specific":{"cpe":"cpe:2.3:a:google:firebase\\/util:*:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.3.4"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["rxfire@4.0.0","firebase@8.0.0","@firebase/util@0.3.3","@firebase/storage@0.4.0","@firebase/rules-unit-testing@1.0.9","@firebase/remote-config@0.1.29","@firebase/performance@0.4.3","@firebase/messaging@0.7.2","@firebase/installations@0.4.18","@firebase/functions@0.6.0","@firebase/functions-types@0.4.0","@firebase/firestore@2.0.0","@firebase/firestore-types@2.0.0","@firebase/database@0.7.0","@firebase/database-types@0.6.0","@firebase/component@0.1.20","@firebase/auth@0.15.1","@firebase/app@0.6.12","@firebase/analytics@0.6.1","rxfire@3.13.2","firebase@7.15.2","@firebase/util@0.2.49","@firebase/testing@0.20.2","@firebase/storage@0.3.36","@firebase/remote-config@0.1.23","@firebase/performance@0.3.7","@firebase/messaging@0.6.18","@firebase/installations@0.4.12","@firebase/functions@0.4.46","@firebase/firestore@1.15.2","@firebase/database@0.6.5","@firebase/component@0.1.14","@firebase/auth@0.14.7","@firebase/app@0.6.6","@firebase/analytics@0.3.7","rxfire@3.9.14","firebase@7.9.2","@firebase/webchannel-wrapper@0.2.36","@firebase/util@0.2.41","@firebase/testing@0.16.12","@firebase/storage@0.3.27","@firebase/storage-types@0.3.10","@firebase/remote-config@0.1.14","@firebase/remote-config-types@0.1.7","@firebase/performance@0.2.33","@firebase/performance-types@0.0.10","@firebase/messaging@0.6.7","@firebase/messaging-types@0.4.3","@firebase/logger@0.1.36","@firebase/installations@0.4.3","@firebase/installations-types@0.3.2","@firebase/functions@0.4.35","@firebase/functions-types@0.3.15","@firebase/firestore@1.11.2","@firebase/firestore-types@1.9.2","@firebase/database@0.5.22","@firebase/database-types@0.4.12","@firebase/component@0.1.6","@firebase/auth@0.13.6","@firebase/auth-types@0.9.6","@firebase/auth-interop-types@0.1.3","@firebase/app@0.5.5","@firebase/app-types@0.5.2","@firebase/analytics@0.2.14","@firebase/analytics-types@0.2.7","@firebase/analytics-interop-types@0.1.3","rxfire@3.9.13","firebase@7.9.1","@firebase/testing@0.16.11","@firebase/messaging@0.6.6","@firebase/functions@0.4.34","@firebase/firestore@1.11.1","rxfire@3.9.6","firebase@7.6.1","@firebase/testing@0.16.4","@firebase/firestore@1.9.1","@firebase/database@0.5.17","rxfire@3.8.3","firebase@7.0.0","@firebase/testing@0.13.3","@firebase/remote-config@0.1.0","@firebase/remote-config-types@0.1.0","@firebase/polyfill@0.3.23","@firebase/messaging@0.5.0","@firebase/functions@0.4.19","@firebase/firestore@1.5.4","@firebase/database@0.5.5","@firebase/database-types@0.4.4","@firebase/app@0.4.18","@firebase/app-types@0.4.4","@firebase/analytics@0.1.0","@firebase/analytics-types@0.1.0","rxfire@3.8.2","firebase@6.6.2","@firebase/util@0.2.28","@firebase/testing@0.13.2","@firebase/storage@0.3.12","@firebase/polyfill@0.3.22","@firebase/performance@0.2.19","@firebase/messaging@0.4.11","@firebase/logger@0.1.25","@firebase/installations@0.2.7","@firebase/functions@0.4.18","@firebase/firestore@1.5.3","@firebase/database@0.5.4","@firebase/app@0.4.17","rxfire@3.7.0","firebase@6.4.2","@firebase/testing@0.12.2","@firebase/performance@0.2.17","@firebase/firestore@1.4.12","rxfire@3.6.9","firebase@6.3.4","@firebase/util@0.2.24","@firebase/testing@0.11.9","@firebase/storage@0.3.8","@firebase/polyfill@0.3.18","@firebase/performance@0.2.14","@firebase/messaging@0.4.7","@firebase/logger@0.1.21","@firebase/installations@0.2.3","@firebase/functions@0.4.14","@firebase/firestore@1.4.8","@firebase/database@0.4.11","@firebase/auth@0.11.7","@firebase/app@0.4.13","@firebase/app-types@0.4.3","rxfire@3.6.8","firebase@6.3.3","@firebase/testing@0.11.8","@firebase/firestore@1.4.7","@firebase/database@0.4.10","rxfire@3.6.2","firebase@6.2.2","@firebase/testing@0.11.2","@firebase/storage@0.3.4","@firebase/performance@0.2.9","@firebase/firestore@1.4.2","@firebase/app@0.4.7","rxfire@3.4.2","firebase@5.11.0","@firebase/webchannel-wrapper@0.2.19","@firebase/util@0.2.14","@firebase/testing@0.9.0","@firebase/storage@0.2.15","@firebase/storage-types@0.2.11","@firebase/polyfill@0.3.13","@firebase/performance@0.2.0","@firebase/performance-types@0.0.1","@firebase/messaging@0.3.19","@firebase/messaging-types@0.2.11","@firebase/logger@0.1.13","@firebase/installations@0.1.0","@firebase/installations-types@0.1.0","@firebase/functions@0.4.6","@firebase/functions-types@0.3.5","@firebase/firestore@1.2.2","@firebase/firestore-types@1.2.1","@firebase/database@0.3.20","@firebase/database-types@0.3.11","@firebase/auth@0.10.2","@firebase/auth-types@0.6.1","@firebase/app@0.3.17","@firebase/app-types@0.3.10","rxfire@3.2.2","firebase@5.7.2","@firebase/testing@0.5.2","@firebase/firestore@0.9.2","rxfire@3.2.1","firebase@5.7.1","@firebase/testing@0.5.1","@firebase/firestore@0.9.1","@firebase/database@0.3.8","@firebase/auth@0.9.1","rxfire@3.2.0","firebase@5.7.0","@firebase/testing@0.5.0","@firebase/firestore@0.9.0","@firebase/firestore-types@0.8.0","@firebase/auth@0.9.0","@firebase/auth-types@0.5.0","rxfire@3.1.0","firebase@5.6.0","@firebase/testing@0.4.0","@firebase/auth@0.8.0","@firebase/auth-types@0.4.0","rxfire@3.0.11","firebase@5.5.9","@firebase/util@0.2.3","@firebase/testing@0.3.3","@firebase/messaging@0.3.7","@firebase/logger@0.1.2","@firebase/functions@0.3.3","@firebase/firestore@0.8.8","@firebase/database@0.3.7","@firebase/app@0.3.5","rxfire@3.0.10","firebase@5.5.8","@firebase/testing@0.3.2","@firebase/functions@0.3.2","@firebase/functions-types@0.2.1","@firebase/firestore@0.8.7","@firebase/auth@0.7.9","rxfire@3.0.9","firebase@5.5.7","@firebase/testing@0.3.1","@firebase/storage@0.2.4","rxfire@3.0.8","firebase@5.5.6","@firebase/testing@0.3.0","@firebase/firestore@0.8.6","rxfire@3.0.7","firebase@5.5.5","@firebase/firestore@0.8.5","rxfire@3.0.6","firebase@5.5.4","@firebase/webchannel-wrapper@0.2.11","@firebase/firestore@0.8.4","@firebase/auth@0.7.8","rxfire@3.0.5","firebase@5.5.3","@firebase/firestore@0.8.3","rxfire@3.0.4","firebase@5.5.2","@firebase/webchannel-wrapper@0.2.10","@firebase/firestore@0.8.2","@firebase/auth@0.7.7","rxfire@3.0.3","firebase@5.5.1","@firebase/webchannel-wrapper@0.2.9","@firebase/functions@0.3.1","@firebase/firestore@0.8.1","@firebase/database@0.3.6","@firebase/auth@0.7.6","rxfire@3.0.2","firebase@5.5.0","@firebase/util@0.2.2","@firebase/messaging@0.3.6","@firebase/firestore@0.8.0","@firebase/firestore-types@0.7.0","@firebase/database@0.3.5","@firebase/auth@0.7.5","@firebase/app@0.3.4","rxfire@3.0.1","firebase@5.4.2","@firebase/firestore@0.7.2","@firebase/auth@0.7.4","rxfire@3.0.0","firebase@5.4.1","@firebase/firestore@0.7.1","@firebase/auth@0.7.3","rxfire@2.0.0","firebase@5.4.0","@firebase/firestore@0.7.0","@firebase/firestore-types@0.6.0","firebase@5.3.1","@firebase/firestore@0.6.1","@firebase/auth@0.7.2","firebase@5.3.0","@firebase/firestore@0.6.0","@firebase/firestore-types@0.5.0","@firebase/auth@0.7.1","firebase@5.2.0","@firebase/functions@0.3.0","@firebase/functions-types@0.2.0","@firebase/firestore@0.5.6","@firebase/database@0.3.4","firebase@5.1.0","@firebase/messaging@0.3.5","@firebase/firestore@0.5.5","@firebase/auth@0.7.0","@firebase/auth-types@0.3.4","firebase@5.0.4","@firebase/storage@0.2.3","@firebase/storage-types@0.2.3","@firebase/polyfill@0.3.3","@firebase/messaging@0.3.4","@firebase/messaging-types@0.2.3","@firebase/functions@0.2.4","@firebase/functions-types@0.1.3","@firebase/firestore@0.5.4","@firebase/firestore-types@0.4.3","@firebase/database@0.3.3","@firebase/database-types@0.3.2","@firebase/auth@0.5.3","@firebase/auth-types@0.3.3","@firebase/app@0.3.3","@firebase/app-types@0.3.2","firebase@5.0.3","@firebase/util@0.2.1","@firebase/polyfill@0.3.2","@firebase/messaging@0.3.3","@firebase/functions@0.2.3","@firebase/firestore@0.5.3","@firebase/firestore-types@0.4.2","@firebase/database@0.3.2","@firebase/app@0.3.2","firebase@5.0.2","@firebase/storage@0.2.2","@firebase/storage-types@0.2.2","@firebase/messaging@0.3.2","@firebase/messaging-types@0.2.2","@firebase/functions@0.2.2","@firebase/functions-types@0.1.2","@firebase/firestore@0.5.2","@firebase/firestore-types@0.4.1","@firebase/database@0.3.1","@firebase/database-types@0.3.1","@firebase/auth@0.5.2","@firebase/auth-types@0.3.2","@firebase/app@0.3.1","@firebase/app-types@0.3.1","firebase@5.0.1","@firebase/storage@0.2.1","@firebase/storage-types@0.2.1","@firebase/messaging@0.3.1","@firebase/messaging-types@0.2.1","@firebase/functions@0.2.1","@firebase/firestore@0.5.1","@firebase/auth@0.5.1","@firebase/auth-types@0.3.1","firebase@5.0.0","@firebase/util@0.2.0","@firebase/storage@0.2.0","@firebase/storage-types@0.2.0","@firebase/messaging@0.3.0","@firebase/messaging-types@0.2.0","@firebase/functions@0.2.0","@firebase/firestore@0.5.0","@firebase/firestore-types@0.4.0","@firebase/database@0.3.0","@firebase/database-types@0.3.0","@firebase/auth@0.5.0","@firebase/auth-types@0.3.0","@firebase/app@0.3.0","@firebase/app-types@0.3.0","firebase@4.13.1","@firebase/firestore@0.4.1","firebase@4.13.0","@firebase/webchannel-wrapper@0.2.8","@firebase/util@0.1.11","@firebase/storage@0.1.9","@firebase/storage-types@0.1.3","@firebase/polyfill@0.3.1","@firebase/messaging@0.2.4","@firebase/messaging-types@0.1.3","@firebase/logger@0.1.1","@firebase/functions@0.1.1","@firebase/functions-types@0.1.1","@firebase/firestore@0.4.0","@firebase/firestore-types@0.3.0","@firebase/database@0.2.2","@firebase/database-types@0.2.1","@firebase/auth@0.4.2","@firebase/auth-types@0.2.1","@firebase/app@0.2.0","@firebase/app-types@0.2.0","firebase@4.12.1","@firebase/webchannel-wrapper@0.2.7","@firebase/messaging@0.2.3","@firebase/firestore@0.3.7","@firebase/auth@0.4.1","firebase@4.12.0","@firebase/polyfill@0.3.0","@firebase/functions@0.1.0","@firebase/functions-types@0.1.0","@firebase/firestore@0.3.6","@firebase/database@0.2.1","@firebase/auth@0.4.0","@firebase/auth-types@0.2.0","firebase@4.11.0","@firebase/polyfill@0.2.0","@firebase/messaging@0.2.2","@firebase/logger@0.1.0","@firebase/firestore@0.3.5","@firebase/database@0.2.0","firebase@4.10.1","@firebase/util@0.1.10","@firebase/storage@0.1.8","@firebase/storage-types@0.1.2","@firebase/polyfill@0.1.6","@firebase/messaging@0.2.1","@firebase/messaging-types@0.1.2","@firebase/firestore@0.3.4","@firebase/firestore-types@0.2.2","@firebase/database@0.1.11","@firebase/database-types@0.1.2","@firebase/auth@0.3.4","@firebase/auth-types@0.1.2","@firebase/app@0.1.10","@firebase/app-types@0.1.2","firebase@4.10.0","@firebase/util@0.1.9","@firebase/storage@0.1.7","@firebase/polyfill@0.1.5","@firebase/messaging@0.2.0","@firebase/firestore@0.3.3","@firebase/database@0.1.10","@firebase/app@0.1.9","firebase@4.9.1","@firebase/util@0.1.8","@firebase/messaging@0.1.9","@firebase/firestore@0.3.2","@firebase/database@0.1.9","@firebase/auth@0.3.3","@firebase/app@0.1.8","firebase@4.9.0","firebase-webpack-test@0.2.1","firebase-typescript-test@0.2.1","firebase-package-typings-test@0.2.1","firebase-messaging-selenium-test@0.2.1","firebase-browserify-test@0.2.1","@firebase/util@0.1.7","@firebase/messaging@0.1.8","@firebase/firestore@0.3.1","@firebase/firestore-types@0.2.1","@firebase/database@0.1.8","@firebase/app@0.1.7","firebase@4.9.0-2","firebase-webpack-test@0.2.1-1","firebase-typescript-test@0.2.1-1","firebase-package-typings-test@0.2.1-1","firebase-messaging-selenium-test@0.2.1-1","firebase-browserify-test@0.2.1-1","@firebase/firestore@0.3.1-1","@firebase/firestore-types@0.2.1-1","firebase@4.9.0-1","firebase-webpack-test@0.2.1-0","firebase-typescript-test@0.2.1-0","firebase-package-typings-test@0.2.1-0","firebase-messaging-selenium-test@0.2.1-0","firebase-browserify-test@0.2.1-0","@firebase/firestore@0.3.1-0","@firebase/firestore-types@0.2.1-0","firebase@4.9.0-0","firebase-webpack-test@0.2.0-0","firebase-typescript-test@0.2.0-0","firebase-package-typings-test@0.2.0-0","firebase-messaging-selenium-test@0.2.0-0","firebase-browserify-test@0.2.0-0","@firebase/firestore@0.3.0-0","@firebase/firestore-types@0.2.0-0","firebase@4.8.2","firebase-webpack-test@0.1.3","firebase-typescript-test@0.1.3","firebase-package-typings-test@0.1.1","firebase-messaging-selenium-test@0.1.3","firebase-browserify-test@0.1.3","@firebase/webchannel-wrapper@0.2.6","@firebase/util@0.1.6","@firebase/storage@0.1.6","@firebase/storage-types@0.1.1","@firebase/polyfill@0.1.4","@firebase/messaging@0.1.7","@firebase/messaging-types@0.1.1","@firebase/firestore@0.2.3","@firebase/firestore-types@0.1.1","@firebase/database@0.1.7","@firebase/database-types@0.1.1","@firebase/auth@0.3.2","@firebase/auth-types@0.1.1","@firebase/app@0.1.6","@firebase/app-types@0.1.1","firebase@4.8.2-0","firebase-webpack-test@0.1.3-0","firebase-typescript-test@0.1.3-0","firebase-package-typings-test@0.1.1-0","firebase-messaging-selenium-test@0.1.3-0","firebase-browserify-test@0.1.3-0","@firebase/webchannel-wrapper@0.2.6-0","@firebase/util@0.1.6-0","@firebase/storage@0.1.6-0","@firebase/storage-types@0.1.1-0","@firebase/polyfill@0.1.4-0","@firebase/messaging@0.1.7-0","@firebase/messaging-types@0.1.1-0","@firebase/firestore@0.2.3-0","@firebase/firestore-types@0.1.1-0","@firebase/database@0.1.7-0","@firebase/database-types@0.1.1-0","@firebase/auth@0.3.2-0","@firebase/auth-types@0.1.1-0","@firebase/app@0.1.6-0","@firebase/app-types@0.1.1-0","firebase@4.8.1","firebase-webpack-test@0.1.2","firebase-typescript-test@0.1.2","firebase-messaging-selenium-test@0.1.2","firebase-browserify-test@0.1.2","@firebase/util@0.1.5","@firebase/storage@0.1.5","@firebase/storage-types@0.1.0","@firebase/messaging@0.1.6","@firebase/messaging-types@0.1.0","@firebase/firestore@0.2.2","@firebase/firestore-types@0.1.0","@firebase/database@0.1.6","@firebase/database-types@0.1.0","@firebase/auth@0.3.1","@firebase/auth-types@0.1.0","@firebase/app@0.1.5","@firebase/app-types@0.1.0","firebase@4.8.0","firebase-webpack-test@0.1.1","firebase-typescript-test@0.1.1","firebase-messaging-selenium-test@0.1.1","firebase-firestore-integration-test@1.0.1","firebase-browserify-test@0.1.1","@firebase/webchannel-wrapper@0.2.5","@firebase/util@0.1.4","@firebase/storage@0.1.4","@firebase/polyfill@0.1.3","@firebase/messaging@0.1.5","@firebase/firestore@0.2.1","@firebase/database@0.1.5","@firebase/auth@0.3.0","@firebase/app@0.1.4","firebase@4.7.0","@firebase/util@0.1.3","@firebase/storage@0.1.3","@firebase/messaging@0.1.4","@firebase/firestore@0.2.0","@firebase/database@0.1.4","@firebase/app@0.1.3","firebase@4.6.2","@firebase/webchannel-wrapper@0.2.4","@firebase/firestore@0.1.4","@firebase/auth@0.2.2","firebase@4.6.1","@firebase/util@0.1.2","@firebase/storage@0.1.2","@firebase/polyfill@0.1.2","@firebase/messaging@0.1.3","@firebase/firestore@0.1.3","@firebase/database@0.1.3","@firebase/auth@0.2.1","@firebase/app@0.1.2","firebase@4.6.0","@firebase/messaging@0.1.2","@firebase/firestore@0.1.2","@firebase/database@0.1.2","@firebase/auth@0.2.0","firebase@4.5.2","@firebase/webchannel-wrapper@0.2.3","@firebase/util@0.1.1","@firebase/storage@0.1.1","@firebase/polyfill@0.1.1","@firebase/messaging@0.1.1","@firebase/firestore@0.1.1","@firebase/database@0.1.1","@firebase/auth@0.1.1","@firebase/app@0.1.1","v4.5.1","v4.5.0","v4.2.0","v4.1.5","v4.1.4","v4.1.1","v4.1.0","4.1.0","v4.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7765.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}