Vulnerability · Published May 3, 2021 · Assigned by mitre
CVE-2021-28860
Critical 9.1
In plain English
A critical-severity security flaw in the mixme package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)1.8%top 20.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | mixme | 0.5.1 | GHSA-79jw-6wg7-r9g4 |
| npm | mixme | 0.5.1 | GHSA-r5cq-9537-9rpf |