Executive brief
The mde utilities library is a JavaScript utility package used by developers to add common helper functions to applications. A prototype pollution vulnerability in the _mix function allows attackers to inject malicious properties into JavaScript object prototypes, potentially causing application crashes or enabling further attacks without requiring any authentication or user interaction.
Technical details
The vulnerability is a prototype pollution flaw in the _mix function of mde utilities. Prototype pollution occurs when user-controlled input is merged into JavaScript object prototypes through unsafe object property manipulation, allowing an attacker to modify the behavior of all objects in the application. The vulnerability affects all versions up to and including 1.0.6, is network-reachable, and requires no authentication or user interaction. An attacker can exploit this to deny service by corrupting object prototypes, though the reported impact focuses on availability degradation. No patches are currently available as the package appears unmaintained.
Affected products
- mde utilities 0 through 1.0.6
Timeline
- 2023-02-28: disclosed
- 2023-02-28: advisory