GHSA-pc58-wgmc-hfjr

Suggest an improvement
Source
https://github.com/advisories/GHSA-pc58-wgmc-hfjr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-pc58-wgmc-hfjr/GHSA-pc58-wgmc-hfjr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pc58-wgmc-hfjr
Aliases
Published
2022-02-09T22:49:10Z
Modified
2023-11-08T04:04:10.761928Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Prototype Pollution in mout
Details

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.

Database specific 
{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1321"
    ],
    "nvd_published_at": "2020-12-11T11:15:00Z",
    "github_reviewed_at": "2021-04-08T21:52:43Z",
    "severity": "HIGH"
}
References

Affected packages

npm / mout

Package

Name
mout
View open source insights on deps.dev
Purl
pkg:npm/mout

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-pc58-wgmc-hfjr/GHSA-pc58-wgmc-hfjr.json"