CVE-2022-21213: Prototype Pollution in mout
Summary
CVE-2022-21213: Prototype Pollution in mout. Affects mout versions < 1.2.4. Fixed in 1.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is mout, an npm package. mout provides a collection of utility functions for JavaScript, including functions for manipulating objects, arrays, and other data types. It is widely used in various applications and projects. However, all versions of mout are vulnerable to a prototype pollution vulnerability.
Vulnerability Detail
The vulnerability in mout is related to the functions deepFillIn and deepMixIn. These functions are used to recursively fill missing properties and mix objects into the target object, respectively. However, the key used to access the target object recursively is not properly checked, allowing an attacker to exploit this vulnerability. This vulnerability is a result of an incomplete fix for a previous vulnerability (CVE-2020-7792). The impact of this vulnerability can be severe, as an attacker can manipulate the prototype of objects and potentially execute arbitrary code.
How To Fix
Latest published version: 1.2.4 as of 23 Oct 2026
npm install mout@1.2.4The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of mout to mitigate the risk of exploitation.
Conclusion
The mout package is vulnerable to a prototype pollution issue that can be exploited to execute arbitrary code. It is crucial to update to version 1.2.4 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for mout →
FAQ
mout is an npm package that provides utility functions for JavaScript, including object manipulation and array operations.
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of objects, leading to unexpected behavior and potential code execution.
By exploiting the prototype pollution vulnerability in mout, an attacker can manipulate the prototype of objects and potentially execute arbitrary code.
Yes, this vulnerability is an incomplete fix for a previous vulnerability (CVE-2020-7792).
The impact of this vulnerability can be severe, as it allows an attacker to manipulate objects' prototypes and potentially execute arbitrary code.
References
Related vulnerabilities
Recent vulnerabilities recorded for mout.
