CVE-2018-3719

mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Score

CVSS 3.1 8.8 High

Status

Modified - support@hackerone.com

Published

2018-06-07

Last modified

2024-09-17

Weaknesses

CWE-20, CWE-471

Affected products

• Mixin-deep Node Module (Hackerone)
• Mixin-deep (Mixin-deep Project)

References

• https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9c
• https://hackerone.com/reports/311236