GitHub Advisoryadvisory · npm

GHSA-79jw-6wg7-r9g4 Use of Potentially Dangerous Function in mixme

HIGH Published 2021-05-06 Modified 2021-05-07 Official page ↗
Aliases
CVE-2021-29491
Ecosystem
npm
Packages
mixme
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-913
Reviewed
2021-05-05

Affected packages

• npm mixme: < 0.5.1 → fixed in 0.5.1

Description

Impact In Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS). Patches The problem is corrected starting with version 0.5.1. References Issue: https://github.com/adaltas/node-mixme/issues/1 Commit: https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-913 Improper Control of Dynamically-Managed Code Resources weakness

References