GHSA-65RP-MHQF-8GJ3 rangy vulnerable to Prototype Pollution

All versions of the package rangy are vulnerable to Prototype Pollution when using the extend function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype...

Buffer overflow

All versions of the package rangy are vulnerable to Prototype Pollution when using the extend function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype...

CVE-2023-26102

CVE-2023-26102 affects the rangy package, where all versions are vulnerable to a prototype pollution flaw in the extend() function of rangy-core.js. The vulnerability arises from an unsafe recursive merge that can copy attacker-controlled properties onto Object.prototype, enabling pollution of al...

Prototype Pollution

Overview rangy is an A cross-browser DOM range and selection library Affected versions of this package are vulnerable to Prototype Pollution when using the extend function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototy...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via object-extend. PoC js const extend = require"object-extend"; const payload = JSON.parse'"proto":"isAdmin":"yes"'; extend, payload; const obj = "a":1; console.logobj.isAdmin // print yes on arbitrary objects since...

Prototype Pollution

Overview putil-merge is a Lightweight solution for merging multiple objects into one. Also it supports deep merge. Affected versions of this package are vulnerable to Prototype Pollution. The merge function does not check the values passed into the argument. An attacker can supply a malicious val...

Denial of Service (DoS)

Overview bignum is an Arbitrary precision integral arithmetic for Node.js using OpenSSL. This library is based on node-bigint by substack, but instead of using libgmp, it uses the builtin bignum functionality provided by OpenSSL. The advantage is that OpenSSL is already part of Node.js, so this...

Prototype Pollution

Overview set-in is a set value of nested associative structure given array of keys Affected versions of this package are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix of...

Prototype Pollution

Overview deep-get-set is a Set and get values on objects via dot-notation strings. Affected versions of this package are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715 POC: js let deep = require'deep-get-set';...

GHSA-GJM5-83CW-P3P2 Prototype Pollution in extend2

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...

CVE-2021-23568

CVE-2021-23568 affects the JavaScript package extend2 (versions before 1.0.1). The vulnerability is a Prototype Pollution in the extend function caused by unsafe recursive merge, enabling an attacker to inject properties (such as proto ) into Object.prototype, potentially leading to DoS or remote...

Prototype Pollution

Overview extend2 is a forked from node-extend, the difference is overriding array as primitive when deep clone. Affected versions of this package are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge. POC: js var e = require "extend2" etrue, ,...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype. PoC js var jsgui=require'jsgui-lang-essentials'; var obj=; console.log"start: " +...

Prototype Pollution

Overview @cookiex/deep is a Tool to assign properties recursively and create recursion features in an easy way. Affected versions of this package are vulnerable to Prototype Pollution. The global proto object can be polluted using the proto object. PoC var deep = require"@cookiex/deep" const targ...

Prototype Pollution

Overview com.graphhopper:graphhopper-web-bundle is a GraphHopper routing engine as a web-service Affected versions of this package are vulnerable to Prototype Pollution. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or proto payload. P...

Prototype Pollution

Overview record-like-deep-assign is a Recursively assigns enumerable own properties of the given sources to a target object Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const deepAssign = require'record-like-deep-assign'; let obj = ;...

Prototype Pollution

Overview lutils is an A few reliable utils. Affected versions of this package are vulnerable to Prototype Pollution via the main merge function. PoC const lt = require'lutils'; let obj = ; console.log"Before being polluted: " + obj.polluted; var EVILJSON = JSON.parse'"proto":"polluted":true';...

Prototype Pollution

Overview @ianwalter/merge is a Recursively merge JavaScript Objects Affected versions of this package are vulnerable to Prototype Pollution via the main merge function. Maintainer suggests using @generates/merger instead. PoC const merge = require'@ianwalter/merge'; let obj = ; console.log"Before...

Prototype Pollution

Overview merge-change is a Deep merge of objects and other types, also for patches and immutable updates. Affected versions of this package are vulnerable to Prototype Pollution via the utils.set function. Details Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution...

Prototype Pollution

Overview nedb is an embedded persistent or in memory database for Node.js, nw.js, Electron and browsers, 100% JavaScript, no binary dependency. Affected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of...