CVE-2021-28860

Katalog CVE

CVSS 9.1 · Critical EPSS 1,8%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada adaltas mixme. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).

Rincian

Terbit di NVD

3 Mei 2021

Terakhir diubah

9 Juli 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028 patch · advisory pihak ketiga
• https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4 patch · advisory pihak ketiga
• https://github.com/adaltas/node-mixme/issues/1 issue tracking · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210618-0005/ advisory pihak ketiga
• https://www.npmjs.com/~david advisory pihak ketiga