GHSA-3mpr-hq3p-49h9

ghsaUSosv

Prototype Pollution in mixin-deep

view advisory published 2018-07-26Licence: CC-BY-4.0

Versions of `mixin-deep` before 1.3.1 are vulnerable to prototype pollution via merging functions. ## Recommendation Update to version 1.3.1 or later.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-3719US	high8.8	2.09% (82nd)	—	2018-06-07
mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" vi…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-3mpr-hq3p-49h9ADVISORY
https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9cWEB
https://hackerone.com/reports/311236WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-3719ADVISORY
https://www.npmjs.com/advisories/578WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan