{"action":"Upgrade mixin-deep to 1.3.2 or later.","affected":[{"fixed":"1.3.2","introduced":"0"},{"fixed":"2.0.1","introduced":"2.0.0"}],"component":"mixin-deep","cve_ids":["CVE-2019-10746"],"ecosystem":"npm","epss":0.03651,"exploited":false,"fixed_versions":["1.3.2","2.0.1"],"ghsa_id":"GHSA-fhjf-83wg-r2j9","id":"tcs_01M5KFNKRDQ3NT6BS0PFW5DX8D","modified_at":"2026-09-10T03:48:25.650276868Z","published_at":"2019-08-27T17:42:33Z","references":["https://osv.dev/vulnerability/GHSA-fhjf-83wg-r2j9","https://nvd.nist.gov/vuln/detail/CVE-2019-10746","https://github.com/jonschlinkert/mixin-deep/commit/8f464c8ce9761a8c9c2b3457eaeee9d404fa7af9","https://github.com/jonschlinkert/mixin-deep/commit/90ee1fab375fccfd9b926df718243339b4976d50","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFNIVG2XYFPZJY3DYYBJASZ7ZMKBMIJT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXRA365KZCUNXMU3KDH5JN5BEPNIGUKC","https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212","https://www.npmjs.com/advisories/1013","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-fhjf-83wg-r2j9","url":"https://osv.dev/vulnerability/GHSA-fhjf-83wg-r2j9"}],"summary":"Prototype Pollution in mixin-deep"}