The package deepmerge@4.2.2 is introduced as a transitive dependency through Twilio Paste packages and is flagged by Snyk for Prototype Pollution.

[ksadhwani]

Description

The package deepmerge@4.2.2 is introduced as a transitive dependency through Twilio Paste packages and is flagged by Snyk for Prototype Pollution.

Vulnerability:

• Package: deepmerge@4.2.2
• Vulnerability: Prototype Pollution via mergeObject() and malicious __proto__ keys
• CWE: CWE-1321 (Prototype Pollution)
• Snyk status: Fixed version not available
• Exploit maturity: Not Defined

Introduced through:

• @twilio-paste/box@10.3.0
• @twilio-paste/chat-composer@5.2.1
• @twilio-paste/customization@8.2.0
• @twilio-paste/text@10.1.1
• @twilio-paste/core@20.16.0

Please update the affected Twilio Paste dependency chain to use a non-vulnerable version of deepmerge, or provide a recommended supported mitigation if no patched version is currently available.

Link to Reproduction

https://www.npmjs.com/package/deepmerge

Twilio Paste Versions

@twilio-paste/box@10.3.0
@twilio-paste/chat-composer@5.2.1
@twilio-paste/customization@8.2.0
@twilio-paste/text@10.1.1
@twilio-paste/core@20.16.0

Environment

• Package manager: npm
• Vulnerability scanner: Snyk
• Vulnerable package: deepmerge@4.2.2
• Status: No fixed version currently reported by Snyk

[Vituartzz]

Some context that should help with triage, since "update deepmerge" isn't possible right now.

What Snyk is flagging

It's SNYK-JS-DEEPMERGE-19964053 / CVE-2026-93753 (published 2026-09-20, from deepmerge#273). It affects every release from 4.2.0 up to the latest, 4.3.1, so there is no version to bump to: the fix PR (#274) was closed unmerged, and latest is still 4.3.1 from 2023.

Snyk's "latest non-vulnerable" 4.1.2 is worse, not better. It predates the prototype-poisoning guard entirely, and in my tests it fails even on plain targets.

It's also narrower than classic prototype pollution: Object.prototype is never modified. What happens is that the object returned by merge() can inherit an attacker-chosen prototype when attacker-controlled JSON is merged into a target that has a null prototype, a null placeholder for that key, or an own __proto__ key. Reproduced on 4.2.2 and 4.3.1:

const merge = require('deepmerge');
const body = '{"__proto__":{"isAdmin":true}}';

merge(Object.create(null), JSON.parse(body)).isAdmin;                        // true
merge({ session: null }, JSON.parse(`{"session":${body}}`)).session.isAdmin; // true
merge({ theme: 'x' }, JSON.parse(body)).isAdmin;                             // undefined (plain target is fine)
({}).isAdmin;                                                                // undefined (no global pollution)

Where Paste calls it

• packages/paste-customization/src/utils.ts: merge(baseTheme, overrides) in createCustomTheme, i.e. the theme you pass to CustomizationProvider.
• packages/paste-core/primitives/box/src/StyleFunctions.ts: merge(elementStyles, variantStyles), i.e. the elements prop.
• The button components merge static style constants.

Every merged input is a design-token or style object written by the app developer. With a normal setup, no attacker-controlled data reaches deepmerge.

The one case worth checking in your app: if you build the theme/elements for CustomizationProvider from user-supplied JSON (per-tenant themes saved by customers, a theme taken from a URL, etc.), sanitize it before passing it in. Parse it with secure-json-parse, or drop __proto__ / constructor / prototype keys.

For the Snyk finding

An overrides/resolutions entry won't clear it, since every 4.2+ release is flagged and 4.1.2 is worse. The practical route is a Snyk ignore with an expiry and this justification (developer-controlled input only), revisited when deepmerge or Paste ships a fix. Swapping to a merge helper that rejects those keys by name would remove the finding at the source, but that's the maintainers' call.