7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-26105

GHSA ID

GHSA-wxfj-84xf-7gxv

EPSS Score

0.19693%

CWE

CWE-1321

Published

2/28/2023

Updated

3/8/2023

KEV Status

Technology

JavaScript

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-26105

CVE-2023-26105: mde utilities contains Prototype Pollution

All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-26105

CVE-2023-26105:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-26105

GHSA ID

GHSA-wxfj-84xf-7gxv

EPSS Score

0.19693%

CWE

CWE-1321

Published

2/28/2023

Updated

3/8/2023

KEV Status

Technology

JavaScript

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
utilities	npm	<= 1.0.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Multiple sources (GitHub Advisory, Snyk, NVD) explicitly identify _mix as the vulnerable function.
The GitHub issue #29 demonstrates exploitation via i18n.loadLocale -> mixin -> _mix call chain.
The _mix function's property assignment pattern (targ[p] = src[p]) matches known prototype pollution anti-patterns.
The lack of prototype validation in _mix's merge logic allows proto manipulation, as shown in the PoC.
i18n.loadLocale is included as it's the documented exploitation path that surfaces the vulnerable _mix function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-26105: mde utilities contains Prototype Pollution

CVE-2023-26105:

7.5

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

CVE-2023-26105: mde utilities contains Prototype Pollution

7.5

7.5

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI