The deepobj library provides deep get, set, and delete operations on JavaScript objects. A flaw allows prototype pollution when property paths include the substrings __proto__, constructor, or prototype. Based on the description, it is inferred that if an application constructs such paths from user input, an attacker could inject arbitrary properties into the global Object prototype, altering behavior of all objects in the runtime. This vulnerability is identified as CWE-1321 and is resolved in version 1.0.3.

Any deployment that uses ranfdev:deepobj prior to v1.0.3 and that accepts property paths from user input is affected. Projects relying on deepobj for deep object manipulation without validating or sanitizing property paths are at risk until they upgrade to v1.0.3 or later. Based on the description, it is inferred that accepting property paths as user input constitutes the attack vector.

The CVSS score of 8.2 indicates a high severity. Exploit probability data is not available, and the vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been reported. Based on the description, it is inferred that the flaw can be triggered by any user-supplied property path that is not validated, effectively allowing an attacker to modify the Object prototype. The high score and potential impact identified by CWE-1321 maintain a significant risk, warranting prompt remediation.