CVE-2020-7792

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.

• CWE-1321

• https://github.com/mout/mout/blob/master/src/object/deepFillIn.jsExploit, Third Party Advisory
• https://github.com/mout/mout/blob/master/src/object/deepMixIn.jsExploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1050374Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050373Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-MOUT-1014544Exploit, Third Party Advisory
• https://github.com/mout/mout/blob/master/src/object/deepFillIn.jsExploit, Third Party Advisory
• https://github.com/mout/mout/blob/master/src/object/deepMixIn.jsExploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1050374Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050373Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-MOUT-1014544Exploit, Third Party Advisory

Published

Dec 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7786This affects all versions of package macfromip. The injectio…9.8
• CVE-2020-7787This affects all versions of package react-adal. It is possi…8.2
• CVE-2020-7788This affects the package ini before 1.3.6. If an attacker su…9.8
• CVE-2020-7789This affects the package node-notifier before 9.0.0. It allo…5.6
• CVE-2020-7790This affects the package spatie/browsershot from 0.0.0. By s…5.3
• CVE-2020-7791This affects the package i18n before 2.1.15. Vulnerability a…7.5
• CVE-2020-7793The package ua-parser-js before 0.7.23 are vulnerable to Reg…7.5
• CVE-2020-7794This affects all versions of package buns. The injection poi…9.8
• CVE-2020-7795The package get-npm-package-version before 1.0.7 are vulnera…9.8
• CVE-2020-7796Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allow…9.8
• CVE-2020-7799An issue was discovered in FusionAuth before 1.11.0. An auth…7.2
• CVE-2020-7800The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, wi…8.2