~ / search / GHSA-gjm5-83cw-p3p2

GHSA-gjm5-83cw-p3p2

Prototype Pollution in extend2

Source: GitHub Advisory Database (reviewed) High CVE-2021-23568

Packages

EcosystemPackageAffectedFixed in
npm extend2 < 1.0.1 1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.

References

External links from the advisory. They lead to third-party sites.