Executive brief
mixin-deep is a Node.js library used to deeply merge objects. A vulnerability in this library allows an attacker to inject properties into the global Object prototype, which can lead to application crashes, data corruption, or unauthorized access across the entire application. This affects any software relying on this library to process untrusted user input.
Technical details
The mixin-deep package before version 1.3.1 is vulnerable to prototype pollution (CWE-471/CWE-20) via its merging functions. The root cause is a failure to sanitize the '__proto__' property during the recursive merge process. An attacker can provide a specially crafted object containing a '__proto__' key to inject or modify properties on the global Object prototype. This can be exploited over the network if the application merges user-controlled input, potentially leading to remote code execution, denial of service, or bypass of security checks. The issue is fixed in version 1.3.1 by explicitly excluding the '__proto__' key during the copy operation.
Affected products
- jonschlinkert mixin-deep < 1.3.1
Timeline
- 2018-06-06: disclosed: NVD Published Date
- 2018-07-26: advisory: GitHub Advisory published
- 2018-05-22: patched: Fix commit pushed to repository