Description

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Remediation

References

https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212

https://www.oracle.com//security-alerts/cpujul2021.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXRA365KZCUNXMU3KDH5JN5BEPNIGUKC/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFNIVG2XYFPZJY3DYYBJASZ7ZMKBMIJT/

Related Vulnerabilities

CVE-2020-8137 Vulnerability in maven package org.webjars.npm:uppy

CVE-2021-25912 Vulnerability in npm package dotty

CVE-2015-1370 Vulnerability in npm package marked

CVE-2023-40809 Vulnerability in maven package org.opencrx:opencrx-core-models

CVE-2023-32314 Vulnerability in npm package vm2

Severity

Critical

Classification

CWE-88 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Patch