High severity7.5NVD Advisory· Published Jun 17, 2022· Updated Jun 17, 2026
CVE-2022-21213
CVE-2022-21213
Description
This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability. Note: This vulnerability derives from an incomplete fix of CVE-2020-7792.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
moutnpm | < 1.2.4 | 1.2.4 |
Affected products
3- mout/moutdescription
Patches
Vulnerability mechanics
References
9- github.com/mout/mout/blob/master/src/object/deepFillIn.jsnvdExploitThird Party AdvisoryWEB
- github.com/mout/mout/blob/master/src/object/deepMixIn.jsnvdExploitThird Party AdvisoryWEB
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2870623nvdExploitThird Party Advisory
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2870622nvdExploitThird Party Advisory
- snyk.io/vuln/SNYK-JS-MOUT-2342654nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-vvv8-xw5f-3f88ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-21213ghsaADVISORY
- github.com/mout/mout/commit/17ffdc2a96417a63a0147156dc045e90d0d14c64ghsaWEB
- github.com/mout/mout/pull/279ghsaWEB
News mentions
0No linked articles in our index yet.