crítica
CVE-2019-10746
nodejs-mixin-deep: prototype pollution in function mixin-deep
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta), AlmaLinux (media), Oracle (media), Rocky Linux (media).
Descripción
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | mixin-deep | 1.3.2, 2.0.1 |
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging | 2.0.3-1.module_el8.4.0+2521+c668cc9f y 1 más |
| debian 10 | node-mixin-deep | 1.1.3-3+deb10u1 |
| debian 11 | node-mixin-deep | 2.0.1-1 |
| debian 12 | node-mixin-deep | 2.0.1-1 |
| debian 13 | node-mixin-deep | 2.0.1-1 |
| debian 14 | node-mixin-deep | 2.0.1-1 |
| debian 9 | node-mixin-deep | 1.1.3-1+deb9u1 |
| echo | node-mixin-deep | 2.0.1-1 |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs y 4 más | 1:12.20.1-1.module+el8.3.0+9643+8c99e187 y 3 más |
| Red Hat | kibana, nodejs:10::nodejs-nodemon | sin corrección indicada |
| rocky 8 | nodejs:12::nodejs-nodemon, nodejs:12::nodejs-packaging | 2.0.3-1.module+el8.6.0+982+9fdca2d4 y 1 más |
Mostrar las 21 entradas de 12 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | mixin-deep | 1.3.2, 2.0.1 |
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| debian 10 | node-mixin-deep | 1.1.3-3+deb10u1 |
| debian 11 | node-mixin-deep | 2.0.1-1 |
| debian 12 | node-mixin-deep | 2.0.1-1 |
| debian 13 | node-mixin-deep | 2.0.1-1 |
| debian 14 | node-mixin-deep | 2.0.1-1 |
| debian 9 | node-mixin-deep | 1.1.3-1+deb9u1 |
| echo | node-mixin-deep | 2.0.1-1 |
| Oracle Linux 8 | nodejs | 1:12.20.1-1.module+el8.3.0+9643+8c99e187 |
| Oracle Linux 8 | nodejs-devel | 1:12.20.1-1.module+el8.3.0+9643+8c99e187 |
| Oracle Linux 8 | nodejs-docs | 1:12.20.1-1.module+el8.3.0+9643+8c99e187 |
| Oracle Linux 8 | nodejs-full-i18n | 1:12.20.1-1.module+el8.3.0+9643+8c99e187 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.3.0+9643+8c99e187 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux 8 | npm | 1:6.14.10-1.12.20.1.1.module+el8.3.0+9643+8c99e187 |
| Red Hat | kibana | sin corrección indicada |
| Red Hat | nodejs:10::nodejs-nodemon | sin corrección indicada |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
Referencias
- https://access.redhat.com/security/cve/CVE-2019-10746
- https://bugzilla.redhat.com/show_bug.cgi?id=1795475
- https://bugzilla.redhat.com/show_bug.cgi?id=1795479
- https://bugzilla.redhat.com/show_bug.cgi?id=1892430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1912854
- https://bugzilla.redhat.com/show_bug.cgi?id=1912863
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750
Las 29 referencias
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10746
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7754
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8265
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8287
- https://errata.almalinux.org/8/ALSA-2021-0549.html
- https://errata.rockylinux.org/RLSA-2021:0549
- https://github.com/jonschlinkert/mixin-deep/commit/8f464c8ce9761a8c9c2b3457eaeee9d404fa7af9
- https://github.com/jonschlinkert/mixin-deep/commit/90ee1fab375fccfd9b926df718243339b4976d50
- https://linux.oracle.com/cve/CVE-2019-10746.html
- https://linux.oracle.com/errata/ELSA-2021-0549.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFNIVG2XYFPZJY3DYYBJASZ7ZMKBMIJT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFNIVG2XYFPZJY3DYYBJASZ7ZMKBMIJT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXRA365KZCUNXMU3KDH5JN5BEPNIGUKC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXRA365KZCUNXMU3KDH5JN5BEPNIGUKC/
- https://nvd.nist.gov/vuln/detail/CVE-2019-10746
- https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212
- https://www.cve.org/CVERecord?id=CVE-2019-10746
- https://www.npmjs.com/advisories/1013
- https://www.oracle.com//security-alerts/cpujul2021.html