CVE-2022-37266: Improperly Controlled Modification of Object Prototype Attributes

Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js...

GHSA-GJM5-83CW-P3P2 Prototype Pollution in extend2

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...

Prototype Pollution

extend2 is vulnerable to prototype pollution. The vulnerability exists in extend function of index.js as it allows an attacker to pass the value proto through the name variable...

CVE-2021-23568

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...

Code injection

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...

CVE-2021-23568: Improperly Controlled Modification of Object Prototype Attributes

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge...

Out of bounds write in stackvector

StackVec::extend used the lower and upper bounds from an Iterator's sizehint to determine how many items to push into the stack based vector. If the sizehint implementation returned a lower bound that was larger than the upper bound, StackVec would write out of bounds and overwrite memory on the...

GHSA-CG42-4WRC-GP47 Code Injection in node-extend

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument A of extend functionA,B,as,isAargs located within lib/extend.js is executed by the eval function, resulting in code execution...

Prototype Pollution in decal

This affects all versions of package decal. The vulnerability is in the extend function...

GHSA-J32X-J8PJ-PG2H Prototype Pollution in decal

This affects all versions of package decal. The vulnerability is in the extend function...

Prototype Pollution

decal is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the extend function...

CVE-2020-28450

This affects all versions of package decal. The vulnerability is in the extend function...

Design/Logic Flaw

This affects all versions of package decal. The vulnerability is in the extend function...

CVE-2020-28450

CVE-2020-28450 concerns the package decal and stems from the vulnerable extend function, enabling prototype pollution across all versions. Multiple connected advisories (GHSA-J32X-J8PJ-PG2H; OSV GHSA-J32X-J8PJ-PG2H; SNYK-JS-DECAL-1051028; Veracode) describe the risk of injecting properties into O...

CVE-2020-28450: Undefined Security Weakness

This affects all versions of package decal. The vulnerability is in the extend function...

Shinuza Decimal-js Security Vulnerability

Shinuza Decimal-js is a Javascript-based codebase used to provide decimal calculations for Node applications by Shinuza Individual Developers. A security vulnerability exists in Shinuza Decimal-js, which stems from the extend function...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The vulnerability is in the extend function. PoC const decal = require'decal'; console.log'Before:', .polluted; const o = JSON.parse'"proto":"polluted":"1"'; decal.extend, true, o; console.log'After:', .polluted;...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

Prototype Pollution

All versions of utils-extend are vulnerable to prototype pollution. The extend function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...