CVE-2021-26505

2023-08-1114:15:12

Google

osv.dev

cve-2021-26505

vulnerability

mrswitch

hello.js

remote attackers

arbitrary code

hello.utils.extend

software

8.2 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.9%

JSON

Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.

CPENameOperatorVersion
hello.jseq1.10.1
hello.jseq1.18.3
hello.jseq1.14.1
hello.jseq1.1.3
hello.jseq1.18.5
hello.jseq1.10.0
hello.jseq1.3.3
hello.jseq1.3.0
hello.jseq1.17.0
hello.jseq0.2.1

Name	Operator	Version
hello.js	eq	1.10.1
hello.js	eq	1.18.3
hello.js	eq	1.14.1
hello.js	eq	1.1.3
hello.js	eq	1.18.5
hello.js	eq	1.10.0
hello.js	eq	1.3.3
hello.js	eq	1.3.0
hello.js	eq	1.17.0
hello.js	eq	0.2.1