CVE-2019-10746

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

References

Affected packages

Git / github.com/jonschlinkert/mixin-deep

Affected ranges

Type: GIT
Repo: https://github.com/jonschlinkert/mixin-deep
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

754f0c20e1bc13ea5a21a64fbc7d6ba5f7b359b9

Affected versions

1.*

1.0.1

1.1.0

1.1.2

1.1.3

1.2.0

1.3.0

1.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10746.json"