GitHub Advisoryadvisory · npm

GHSA-675m-85rw-j3w4 Prototype Pollution in just-extend

CRITICAL Published 2019-02-07 Modified 2023-09-07 Official page ↗
Aliases
CVE-2018-16489
Ecosystem
npm
Packages
just-extend
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321, CWE-400
Reviewed
2020-06-16

Affected packages

• npm just-extend: < 4.0.0 → fixed in 4.0.0

Description

Versions of `just-extend` before 4.0.0 are vulnerable to prototype pollution. Provided certain input `just-extend` can add or modify properties of the `Object` prototype. These properties will be present on all objects. Recommendation Update to version `4.0.0` or later.

Related

Alias · CVE (1)

  • CVE-2018-16489 A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through… vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References