CVE-2018-3719 Prototype Pollution in mixin-deep
HighCVSS 8.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm mixin-deep(npm) | < 1.3.1 | 1.3.1 |
| debian/node-mixin-deep(Debian:12) | < 1.1.3-2 | 1.1.3-2 |
| debian/node-mixin-deep(Debian:13) | < 1.1.3-2 | 1.1.3-2 |
| debian/node-mixin-deep(Debian:14) | < 1.1.3-2 | 1.1.3-2 |
| mixin-deep project mixin-deep | < 1.3.1 | 1.3.1 |
| ubuntu/node-mixin-deep(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/node-mixin-deep(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/node-mixin-deep(Ubuntu:26.10) | All versions | No fix listed |
| HackerOne mixin-deep node module | = Versions before 1.3.1 | No fix listed |
| ubuntu/node-mixin-deep(Ubuntu:22.04) | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory
- hackerone.com exploit third-party-advisory
- github.com
- www.npmjs.com
- github.com patch third-party-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-3719 vendor-advisory
- bugs.debian.org issue-tracking