Is CVE-2019-10746 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-10746 being exploited in the wild.

How severe is CVE-2019-10746?

Low severity, with a CVSS score of 3.1, published 27 August 2019.

Which products and versions are affected?

mixin-deep (npm) SEMVER:introduced=0,fixed=1.3.2.

Is there a fix for CVE-2019-10746?

Yes. mixin-deep (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-10746 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-10746?

Check whether you run mixin-deep (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-10746: mixin-deep prototype pollution

CVE-2019-10746 · Severity: low · CVSS 3.1 · Published 2019-08-27

mixin-deep is a JavaScript library used to merge objects in Node.js and browser applications. A prototype pollution vulnerability allows attackers to inject malicious properties into all objects in an application, potentially modifying application behavior, bypassing security checks, or causing denial of service.

Vendors: npm.

Quick answers

Is CVE-2019-10746 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-10746 being exploited in the wild.
How severe is CVE-2019-10746?: Low severity, with a CVSS score of 3.1, published 27 August 2019.
Which products and versions are affected?: mixin-deep (npm) SEMVER:introduced=0,fixed=1.3.2.
Is there a fix for CVE-2019-10746?: Yes. mixin-deep (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-10746 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-10746?: Check whether you run mixin-deep (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mixin-deep (npm): upgrade to 1.3.2 or later
```
npm install mixin-deep@1.3.2
```

Technical details

This is a prototype pollution vulnerability (CWE-88) in the mixinDeep function, which fails to validate which Object properties it updates. An attacker can craft a malicious input object with "constructor" or "prototype" keys that, when merged via mixinDeep, modifies the Object prototype itself. This affects all objects in the JavaScript runtime. The vulnerability requires no authentication and is exploitable via any code path that calls mixinDeep with attacker-controlled input. Patches are available: upgrade to version 1.3.2 (for 1.x) or 2.0.1+ (for 2.x).

Affected products

Jon Schlinkert mixin-deep All versions prior to 1.3.2; 2.0.0

Identifiers

CVE-2019-10746
GHSA-fhjf-83wg-r2j9

Timeline

2019-08-23: disclosed
2019-06-19: patched: Fix committed; patches released in version 1.3.2 and 2.0.1

References

https://github.com/jonschlinkert/mixin-deep/commit/8f464c8ce9761a8c9c2b3457eaeee9d404fa7af9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.