CVE-2021-28860
CriticalCVSS 9.1Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
In the Node.js mixme library before version 0.5.1, an attacker can add or alter object properties via '__proto__' using the mutate() and merge() functions. The polluted attribute is directly assigned to every object in the program.
Risk Assessment
The risk involves potential disruption of application functionality through prototype pollution, which can lead to denial of service (DoS) and compromise data integrity.
Recommendation
Immediately update the mixme library to version 0.5.1 or later, which includes a fix that prevents attacks via '__proto__'.
Original NVD description (English source)
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).