CVE-2019-10746 Prototype Pollution in mixin-deep
Prototype pollution in mixin-deep allows attackers to modify Object.prototype, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10746?
CVE-2019-10746 is a critical vulnerability in Fedoraproject Fedora, published on 23 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Weakness: CWE-88
Which versions are affected by CVE-2019-10746?
4 open source packages ship an affected version, including mixin-deep. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
mixin-deep npm | All versions | 1.3.2 |
mixin-deep npm | All versions | 1.3.2 |
mixin-deep npm | From 2.0.0 | 2.0.1 |
mixin-deep npm | From 2.0.0 | 2.0.1 |
Products include Fedoraproject Fedora, Mixin-Deep Project Mixin-Deep, Oracle Communications Cloud Native Core Network Function Cloud Native Environment.
How do I fix CVE-2019-10746?
Upgrade mixin-deep to a fixed version for your release line: 1.3.2 or 2.0.1.
Is CVE-2019-10746 being exploited?
There is no known exploitation of CVE-2019-10746 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2019-10746, GHSA-fhjf-83wg-r2j9, SNYK-JS-MIXINDEEP-450212, UBUNTU-CVE-2019-10746.