jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...)
because of Object.prototype
pollution. If an unsanitized source object contained an enumerable __proto__
property, it could extend the native Object.prototype
.
{ "nvd_published_at": "2019-04-20T00:29:00Z", "cwe_ids": [ "CWE-1321", "CWE-79" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2019-04-26T16:28:41Z" }