GHSA-qrmc-fj45-qfc2

Suggest an improvement
Source
https://github.com/advisories/GHSA-qrmc-fj45-qfc2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-qrmc-fj45-qfc2/GHSA-qrmc-fj45-qfc2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qrmc-fj45-qfc2
Aliases
Published
2019-02-07T18:03:28Z
Modified
2026-02-03T03:09:19Z
Summary
Prototype Pollution in extend
Details

Versions of extend prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution. The extend() function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.

Recommendation

If you're using extend 3.x upgrade to 3.0.2 or later. If you're using extend 2.x upgrade to 2.0.2 or later.

Database specific 
{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:52:44Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

npm / extend

Package

Name
extend
View open source insights on deps.dev
Purl
pkg:npm/extend

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
3.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-qrmc-fj45-qfc2/GHSA-qrmc-fj45-qfc2.json"

npm / extend

Package

Name
extend
View open source insights on deps.dev
Purl
pkg:npm/extend

Affected ranges

Type
SEMVER
Events
Introduced
1.1.3
Fixed
2.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-qrmc-fj45-qfc2/GHSA-qrmc-fj45-qfc2.json"