CVE-2018-3719

## Vulnerability mixin-deep before version 1.3.1 (npm) contains a prototype pollution vulnerability (MAID). The mixin-deep function does not block __proto__ properties, allowing a malicious user to modify the prototype of Object via __proto__, which causes addition or modification of an existing property that will exist on all objects [1] [2].

Exploitation

An attacker can supply a crafted object containing a __proto__ property with arbitrary payload properties to any API that uses mixin-deep to merge objects. No authentication or special network position is required if the application merges attacker-controlled data. The merge function will walk the nested keys and assign the value to Object.prototype, making the property available on all JavaScript objects in the same process [3].

Impact

Successful exploitation results in prototype pollution. An attacker can add or modify properties on all objects, which can lead to denial of service (by overriding critical properties), or in some contexts, privilege escalation or arbitrary code execution if the polluted property influences security checks or evaluation of untrusted data [1] [3]. The vulnerability has a CVSS v3.1 base score of 7.5 (High) [3].

Mitigation

The fix was released in version 1.3.1, which excludes __proto__ properties from the merge [2]. Users should update to 1.3.1 or later. No workaround is provided for earlier versions; updating is the only mitigation [3].