CVE-2021-26505

Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function...

kinvey-angular-sdk (>=3.4.0, <=3.5.3), kinvey-angular2-sdk (>=3.4.1, <=3.5.2) +6 more potentially affected by CVE-2021-26505 via hellojs (>=1.13.1, <=1.14.1)

hellojs NPM version =1.13.1, =3.4.0, =3.4.1, =3.4.1, =3.4.0, =3.4.1, =3.4.0, =3.4.0, =3.4.1, =3.5.2 Source cves: CVE-2021-26505 Source advisory: OSV:GHSA-G3VF-47FV-8F3C...

CVE-2021-26505

Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function...

CVE-2021-26505

Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function...

CVE-2021-26505

CVE-2021-26505 affects MrSwitch hello.js (v1.18.6). The vulnerability is a prototype pollution flaw in hello.utils.extend that allows remote code execution. Related advisories indicate fixes in v1.18.8 and later; higher-risk impact is confirmed (remote, no user interaction).