~ / search / GHSA-qrmc-fj45-qfc2

GHSA-qrmc-fj45-qfc2

Prototype Pollution in extend

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-16492

Packages

EcosystemPackageAffectedFixed in
npm extend >= 3.0.0, < 3.0.2 3.0.2
npm extend >= 1.1.3, < 2.0.2 2.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `extend` prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution. The `extend()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects. ## Recommendation If you're using `extend` 3.x upgrade to 3.0.2 or later. If you're using `extend` 2.x upgrade to 2.0.2 or later.

References

External links from the advisory. They lead to third-party sites.