CVE-2019-10746
Fixed in a distro release EPSS 4%
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Products: mixin-deep_project mixin-deep, fedoraproject fedora, oracle communications_cloud_native_core_network_function_cloud_native_environment
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | mixin-deep | 1.3.2 |
| npm | mixin-deep | 2.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| Debian 12 | node-mixin-deep | 2.0.1-1 |
| Debian 13 | node-mixin-deep | 2.0.1-1 |
| Debian 14 | node-mixin-deep | 2.0.1-1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.3.0+9715+1718613f |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat Enterprise Linux 8 | npm | 1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs | 0:12.20.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-debuginfo | 0:12.20.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-devel | 0:12.20.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-docs | 0:12.20.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-nodemon | 0:2.0.3-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-npm | 0:6.14.10-12.20.1.1.el7 |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.3.0+100+234774f7 |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.3-1.module+el8.4.0+638+5344c6f7 |
| Rocky Linux 8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
| Ubuntu 18.04 LTS | node-mixin-deep | no fix |