deepHas provides a utility to test the existence of nested object keys and may optionally return that key. In version 1.0.7 a flaw allows an attacker to inject properties onto the global prototype via the constructor.prototype field, which can alter the behavior of all objects in the JavaScript runtime. This weakness is classified as CWE‑1321 and can lead to modification of global object behavior, potentially affecting confidentiality, integrity, and availability depending on how the library is used (inferred).

The vulnerability affects the sharpred:deepHas npm package in version 1.0.7, which runs under Node.js. All applications that depend on this package and supply untrusted input to deepHas are impacted until they upgrade to version 1.0.8 or later.

The CVSS score is 9.4, indicating critical severity. The EPSS score is reported as less than 1%, suggesting that exploitation probability is low overall, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local code that depends on sharpred:deepHas and processes external data; an attacker can supply crafted input that modifies the prototype (inferred). The risk is significant because any target running the affected library becomes vulnerable to prototype pollution attacks (inferred).