Executive brief
mixin-deep is a JavaScript library used to merge objects in Node.js and browser applications. A prototype pollution vulnerability allows attackers to inject malicious properties into all objects in an application, potentially modifying application behavior, bypassing security checks, or causing denial of service.
Technical details
This is a prototype pollution vulnerability (CWE-88) in the mixinDeep function, which fails to validate which Object properties it updates. An attacker can craft a malicious input object with "constructor" or "prototype" keys that, when merged via mixinDeep, modifies the Object prototype itself. This affects all objects in the JavaScript runtime. The vulnerability requires no authentication and is exploitable via any code path that calls mixinDeep with attacker-controlled input. Patches are available: upgrade to version 1.3.2 (for 1.x) or 2.0.1+ (for 2.x).
Affected products
- Jon Schlinkert mixin-deep All versions prior to 1.3.2; 2.0.0
Timeline
- 2019-08-23: disclosed
- 2019-06-19: patched: Fix committed; patches released in version 1.3.2 and 2.0.1