CVE-2020-7765

Name of the Vulnerable Software and Affected Versions @firebase/util versions prior to 0.3.4

Description This issue relates to the deepExtend function within the DeepCopy.ts file. Depending on user input, an attacker can overwrite and pollute the object prototype of a program.

Recommendations For versions prior to 0.3.4, update to version 0.3.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the deepExtend function within the DeepCopy.ts file until a patch is applied. Avoid using user input that could potentially overwrite and pollute the object prototype of a program.