GitHub Advisoryadvisory · npm

GHSA-fhjf-83wg-r2j9 Prototype Pollution in mixin-deep

CRITICAL Published 2019-08-27 Modified 2023-11-29 Official page ↗
Aliases
CVE-2019-10746
Ecosystem
npm
Packages
mixin-deep
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-88
Reviewed
2019-08-27

Affected packages

• npm mixin-deep: < 1.3.2 → fixed in 1.3.2 • npm mixin-deep: >= 2.0.0, < 2.0.1 → fixed in 2.0.1

Description

Versions of `mixin-deep` prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. The `mixinDeep` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. Recommendation If you are using `mixin-deep` 2.x, upgrade to version 2.0.1 or later. If you are using `mixin-deep` 1.x, upgrade to version 1.3.2 or later.

Related

Alias · CVE (1)

  • CVE-2019-10746 mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. vulnerability

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References