CVE-2018-3719: hackerone mixin-deep node module
Vulnerability summary
CVE-2018-3719 is a high (CVSS 8.8) vulnerability in hackerone mixin-deep node module. EPSS estimates a 2.09% chance of exploitation in the next 30 days, higher than 81.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 07-06-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.09%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
-0.03 pp
From 2.12% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-471Modification of Assumed-Immutable Data (MAID)The product does not properly protect an assumed-immutable element from being modified by an attacker.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Debian1 product
- node-mixin-deep< 1.1.3-2
Hackerone1 product
- mixin-deep node moduleVersions before 1.3.1
Mixin-deep_project1 product
- mixin-deep< 1.3.1
Npm1 product
- mixin-deep< 1.3.1
Ubuntu1 product
- node-mixin-deepAll versions (No fix recorded)
5 vendors · 5 products
References
9 links- github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9cX Refsource MISCPatchThird Party AdvisoryWEB
