What is GHSA-84p7-fh9c-6g8h?

GHSA-84p7-fh9c-6g8h is a security advisory published by GitHub Security Advisories with High severity. Prototype Pollution in mixme

Why does GHSA-84p7-fh9c-6g8h have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-84p7-fh9c-6g8h?

GHSA-84p7-fh9c-6g8h affects 1 product, including: npm/mixme:\u003c 0.5.2.

GHSA-84p7-fh9c-6g8hHighDisclosed before NVD

Prototype Pollution in mixme

Vendor

GitHub Security Advisories

Published

September 20, 2021

Last Modified

January 9, 2023

📋 Description

Impact

When copying properties from a source object to a target object, the target object can gain access to certain properties of the source object and modify their content.

Patches

The problem was patch with a more agressive discovery of secured properties to filter out.

🎯 Affected products1

npm/mixme:< 0.5.2

🔗 References (6)

https://github.com/adaltas/node-mixme/security/advisories/GHSA-84p7-fh9c-6g8h
https://github.com/adaltas/node-mixme/issues/1
https://github.com/adaltas/node-mixme/issues/2
https://github.com/adaltas/node-mixme/commit/db70fe9bcbba451e9f8bd794a9fa7cdfa00125ad
https://github.com/advisories/GHSA-79jw-6wg7-r9g4
https://github.com/advisories/GHSA-84p7-fh9c-6g8h