CVE-2018-3719: Prototype Pollution in mixin-deep
Summary
CVE-2018-3719: Prototype Pollution in mixin-deep. Affects mixin-deep versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Also tracked for
- node-mixin-deep · Debian:11
The same CVE-2018-3719 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mixin-deep package is an npm package that provides a utility function for merging objects deeply. It is commonly used in JavaScript projects to combine multiple objects into a single object. This package is vulnerable to prototype pollution, a type of vulnerability where an attacker can modify the prototype of an object and introduce malicious properties or methods. This vulnerability can lead to various security issues, including remote code execution, denial of service, and information disclosure.
Vulnerability Detail
The vulnerability in mixin-deep arises from the improper handling of function merging. Versions of the package before 1.3.1 are affected. By manipulating the merging process, an attacker can pollute the prototype of an object and introduce malicious properties or methods. This can lead to unexpected behavior and security vulnerabilities when the merged object is used in the application. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Minimum fixed version
1.3.1
This is the first release that contains the fix.
npm install mixin-deep@1.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version to address the issue effectively.
Conclusion
The mixin-deep package is vulnerable to prototype pollution, which can have severe security implications. It is crucial to update the package to version 1.3.1 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mixin-deep →
FAQ
Mixin-deep is an npm package used for merging objects deeply in JavaScript projects.
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object and introduce malicious properties or methods.
This vulnerability can lead to various security issues, including remote code execution, denial of service, and information disclosure.
To fix this vulnerability, update the mixin-deep package to version 1.3.1 or later.
No, there is no known workaround for this vulnerability. Updating the package is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for mixin-deep.
