CVE-2022-21213

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7792](https://security.snyk.io/vuln/SNYK-JS-MOUT-1014544).

• CWE-1321

• https://github.com/mout/mout/blob/master/src/object/deepFillIn.jsExploit, Third Party Advisory
• https://github.com/mout/mout/blob/master/src/object/deepMixIn.jsExploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2870623Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2870622Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-MOUT-2342654Exploit, Third Party Advisory
• https://github.com/mout/mout/blob/master/src/object/deepFillIn.jsExploit, Third Party Advisory
• https://github.com/mout/mout/blob/master/src/object/deepMixIn.jsExploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2870623Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2870622Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-MOUT-2342654Exploit, Third Party Advisory

Published

Jun 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21208The package node-opcua before 2.74.0 are vulnerable to Denia…7.5
• CVE-2022-21209The affected product is vulnerable to an out-of-bounds read …7.8
• CVE-2022-2121OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL point…6.5
• CVE-2022-21210An SQL injection vulnerability exists in the AssetActions.as…8.8
• CVE-2022-21211This affects all versions of package posix. When invoking th…7.5
• CVE-2022-21212Improper input validation for some Intel(R) PROSet/Wireless …6.5
• CVE-2022-21214The affected product is vulnerable to a heap-based buffer ov…7.8
• CVE-2022-21215This vulnerability could allow an attacker to force the serv…9.8
• CVE-2022-21216Insufficient granularity of access control in out-of-band ma…6.8
• CVE-2022-21217An out-of-bounds write vulnerability exists in the device Te…9.8
• CVE-2022-21218Uncaught exception in the Intel(R) Trace Analyzer and Collec…5.5
• CVE-2022-21219Out-of-bounds read vulnerability in CX-Programmer v9.76.1 an…7.8