GitHub Advisoryadvisory · npm

GHSA-r5cq-9537-9rpf Prototype Pollution in mixme

CRITICAL Published 2022-02-10 Modified 2021-12-13 Official page ↗
Aliases
CVE-2021-28860
Ecosystem
npm
Packages
mixme
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2021-05-19

Affected packages

• npm mixme: < 0.5.1 → fixed in 0.5.1

Description

Node.js mixme 0.5.0, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).

Related

Alias · CVE (1)

  • CVE-2021-28860 In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge()… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References