CVE-2019-10746

NameCVE-2019-10746
Descriptionmixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs932500

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-mixin-deep (PTS)bullseye2.0.1-2fixed
forky, sid, bookworm, trixie2.0.1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-mixin-deepsourcestretch1.1.3-1+deb9u1
node-mixin-deepsourcebuster1.1.3-3+deb10u1
node-mixin-deepsource(unstable)2.0.1-1932500

Notes

https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212
https://github.com/jonschlinkert/mixin-deep/commit/8f464c8ce9761a8c9c2b3457eaeee9d404fa7af9
https://github.com/jonschlinkert/mixin-deep/issues/6
Search for package or bug name: Reporting problems