Read the docs
TI-2020-06308 Aliases CVE-2020-7792GHSA-pc58-wgmc-hfjr

Prototype pollution in mout

Priority LOW 37CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.

Why it matters now

EPSS 0.02145 82nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed mout (npm): 1.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—moutall versions—No fix listedCNA
—mout (npm)before 1.2.31.2.3Patch availableGHSA-pc58-wgmc-hfjr
  • mout Vendor— Affected all versions Fixed in — No fix listed CNA
  • mout (npm) Vendor— Affected before 1.2.3 Fixed in 1.2.3 Patch available GHSA-pc58-wgmc-hfjr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:moutjs:mout:*:*:*:*:*:node.js:*:*all versionsVulnerableMoutjs
  • cpe:2.3:a:moutjs:mout:*:*:*:*:*:node.js:*:* Versions all versions Vulnerable ·Moutjs

Remediation

  • Fix · GHSA-pc58-wgmc-hfjr mout (npm) Fixed in 1.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7792
  2. 2026-10-03 Alias added: GHSA-pc58-wgmc-hfjr

References

Exploit 2

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences