GitHub Advisoryadvisory · npm

GHSA-6pq3-928q-x6w6 Prototype Pollution

HIGH Published 2020-09-03 Modified 2021-06-07 Official page ↗
Aliases
CVE-2020-8147
Ecosystem
npm
Packages
utils-extend
Severity
High
Weaknesses
CWE-471
Reviewed
2020-08-31

Affected packages

• npm utils-extend: >= 0.0.0 (no fix yet)

Description

All versions of `utils-extend` are vulnerable to prototype pollution. The `extend` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2020-8147 Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in… vulnerability

Weakness · CWE (1)

  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

References