Critical MAID Vulnerability in node-mixin-deep Package
Summary
CVE-2018-3719: mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modific... Affects node-mixin-deep across 2 version ranges.
< 1.1.3-2
< 578b0bc5e74e14de9ef4975f504dc698796bdf9c
Fixed in 1.1.3-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-mixin-deep package is a utility for deep merging objects in JavaScript. It is widely used in various applications to facilitate the combination of multiple objects into one, preserving the structure and properties of the original objects. However, versions prior to 1.3.1 are susceptible to a serious vulnerability that allows unauthorized modification of object prototypes.
Vulnerability Detail
The vulnerability identified as CVE-2018-3719 in the node-mixin-deep package arises from a Modification of Assumed-Immutable Data (MAID) flaw. This allows a malicious user to alter the prototype of 'Object' via the proto property. As a result, it can lead to the addition or modification of properties that affect all objects in the application, potentially compromising data integrity and security. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.1.3-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-mixin-deepTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing a workaround by avoiding the use of the vulnerable features of the node-mixin-deep package. Additionally, you can restrict the use of the proto property in your application code to mitigate the risk temporarily.
Conclusion
The CVE-2018-3719 vulnerability in the node-mixin-deep package poses a significant risk due to its ability to modify object prototypes. It is crucial for developers to upgrade to the latest version to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-mixin-deep →
FAQ
CVE-2018-3719 is a vulnerability in the node-mixin-deep package that allows unauthorized modification of object prototypes, leading to potential security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The consequences include potential data integrity issues and unauthorized access to properties across all objects in the application, which can lead to severe security breaches.
Yes, you can implement workarounds such as avoiding the use of the proto property and restricting its usage in your code.
It is recommended to upgrade to version 1.1.3-2 or later of the node-mixin-deep package to eliminate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for node-mixin-deep.
