~ / search / GHSA-fhjf-83wg-r2j9

GHSA-fhjf-83wg-r2j9

Prototype Pollution in mixin-deep

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10746

Packages

EcosystemPackageAffectedFixed in
npm mixin-deep < 1.3.2 1.3.2
npm mixin-deep >= 2.0.0, < 2.0.1 2.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `mixin-deep` prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. The `mixinDeep` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. ## Recommendation If you are using `mixin-deep` 2.x, upgrade to version 2.0.1 or later. If you are using `mixin-deep` 1.x, upgrade to version 1.3.2 or later.

References

External links from the advisory. They lead to third-party sites.