{"id":"CVE-2018-3719","aliases":["DEBIAN-CVE-2018-3719","EUVD-2018-0215","GHSA-3mpr-hq3p-49h9","UBUNTU-CVE-2018-3719"],"status":"published","title":"Prototype Pollution in mixin-deep","description":"mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0209,"percentile":0.81721,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-471"],"published":"2018-06-07T02:00:00Z","modified":"2026-10-23T18:03:58Z","fixes":[{"ecosystem":"npm","package":"mixin-deep","fixed_in":["1.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-mixin-deep","fixed_in":["1.1.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-mixin-deep","fixed_in":["1.1.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-mixin-deep","fixed_in":["1.1.3-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"node-mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-2"}]}]},{"source":"osv","ecosystem":"npm","package":"mixin-deep","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-2","2.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-mixin-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-3"]}],"products":[{"vendor":"hackerone","product":"mixin-deep node module"},{"vendor":"mixin-deep_project","product":"mixin-deep"}],"references":[{"url":"https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9c","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://hackerone.com/reports/311236","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3719","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3mpr-hq3p-49h9","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/578","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-3719","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-3719","tags":["report"]},{"url":"https://nodesecurity.io/advisories/578","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3719","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-3719","description":"mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2024-09-17T04:19:14.237Z","cwes":["CWE-471"],"updated_at":"2026-11-02T14:35:05.262903Z"}],"euvd":[{"id":"EUVD-2018-0215","description":"mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2024-09-17T04:19:14Z","updated_at":"2026-11-03T00:28:24.323088Z"}],"ghsa":[{"id":"GHSA-3mpr-hq3p-49h9","title":"Prototype Pollution in mixin-deep","description":"Versions of `mixin-deep` before 1.3.1 are vulnerable to prototype pollution via merging functions.\n\n\n## Recommendation\n\nUpdate to version 1.3.1 or later.","status":"published","published":"2018-07-26T15:10:54Z","modified":"2023-03-01T01:32:37Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-471"],"updated_at":"2026-11-02T14:36:46.526285Z"}],"nvd":[{"id":"CVE-2018-3719","description":"mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-06-07T02:29:08.223Z","modified":"2026-06-17T01:57:43.157Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-471","CWE-20"],"updated_at":"2026-11-02T14:04:28.483469Z"}],"osv":[{"id":"CVE-2018-3719","description":"mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-06-07T02:29:08.223Z","modified":"2026-10-20T10:50:27.274242999Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.442568Z"},{"id":"DEBIAN-CVE-2018-3719","description":"mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-06-07T02:29:08.223Z","modified":"2026-10-23T18:03:58.170325361Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"GHSA-3mpr-hq3p-49h9","title":"Prototype Pollution in mixin-deep","description":"Versions of `mixin-deep` before 1.3.1 are vulnerable to prototype pollution via merging functions.\n\n\n## Recommendation\n\nUpdate to version 1.3.1 or later.","status":"published","published":"2018-07-26T15:10:54Z","modified":"2023-11-08T04:00:17.059082Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-471"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"UBUNTU-CVE-2018-3719","description":"mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-06-07T02:29:00Z","modified":"2026-10-17T12:55:26.877517245Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.33562Z"}]}}