CVE-2018-3719

Name	CVE-2018-3719
Description	mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	898315

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-mixin-deep (PTS)	buster	1.1.3-3+deb10u1	fixed
	bullseye	2.0.1-2	fixed
	sid, trixie, bookworm	2.0.1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-mixin-deep	source	stretch	1.1.3-1+deb9u1
node-mixin-deep	source	(unstable)	1.1.3-2			898315

https://nodesecurity.io/advisories/578