GHSA-g3vf-47fv-8f3c

MrSwitch hello.js vulnerable to prototype pollution

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-26505

Packages

Ecosystem	Package	Affected	Fixed in
npm	hellojs	< 1.18.8	1.18.8

Details

As written in the advisory (Markdown source, shown as plain text).

A prototype pollution vulnerability in MrSwitch hello.js prior to version 1.18.8 allows remote attackers to execute arbitrary code via `hello.utils.extend` function.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-26505 advisory
https://github.com/MrSwitch/hello.js/issues/634 web
https://github.com/MrSwitch/hello.js/commit/7ab50aeff2d41991f08d4ad6c0481125eea8f6b7 web
https://github.com/MrSwitch/hello.js package