Executive brief
mixme is a Node.js library used to copy and merge object properties. A prototype pollution vulnerability allows attackers to modify or add properties to objects during the copy process, potentially altering application behavior or gaining unauthorized access to sensitive data stored in object prototypes.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the property copying mechanism of mixme. When copying properties from a source object to a target object, insufficient filtering allows attackers to access and modify protected properties of the target, including prototype chain properties. The attack requires control over the source object being merged. The vulnerability was fixed in version 0.5.2 through more aggressive filtering of secured properties.
Affected products
- Adaltas mixme <0.5.2
Timeline
- 2021-09-16: disclosed: Published to GitHub advisory database
- 2021-09-20: patched: Version 0.5.2 released with fix