CVE-2021-28860 Prototype Pollution in mixme
An attacker can cause denial of service in applications using the mixme library by polluting the prototype via mutate or merge functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28860?
CVE-2021-28860 is a critical vulnerability in n/a, published on 3 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
Weakness: CWE-1321
Which versions are affected by CVE-2021-28860?
2 open source packages ship an affected version, including mixme. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mixme npm | All versions | 0.5.1 |
mixme npm | All versions | 0.5.1 |
Products include Adaltas Mixme.
How do I fix CVE-2021-28860?
Upgrade mixme to 0.5.1 or later.
Is CVE-2021-28860 being exploited?
There is no known exploitation of CVE-2021-28860 in the wild and no public exploit code.
Sources
Also known as CVE-2021-29491, GHSA-r5cq-9537-9rpf.