UBUNTU-CVE-2026-73088

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-73088

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73088.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-73088

Upstream

CVE-2026-73088

Published

2026-08-13T00:00:00Z

Modified

2026-08-13T19:31:04.876866472Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including proto, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.

References

Affected packages

Ubuntu:18.04:LTS / node-browserslist

Package

Name: node-browserslist
Purl: pkg:deb/ubuntu/node-browserslist?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.11.3-1

2.11.3-1build3

2.11.3-1build4

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.11.3-1build4",
            "binary_name": "node-browserslist"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73088.json"

Ubuntu:20.04:LTS / node-browserslist

Package

Name: node-browserslist
Purl: pkg:deb/ubuntu/node-browserslist?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.11.3-1build4

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.11.3-1build4",
            "binary_name": "node-browserslist"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73088.json"

Ubuntu:22.04:LTS / node-browserslist

Package

Name: node-browserslist
Purl: pkg:deb/ubuntu/node-browserslist?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.16.3+~cs5.4.72-3

4.17.0+~cs5.6.76-1

4.18.1+~cs5.1.2-1

4.19.1+~cs5.1.2-1

4.19.1+repack+~cs5.1.2-2

4.19.3+~cs5.1.3-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "4.19.3+~cs5.1.3-1",
            "binary_name": "node-browserslist"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73088.json"

Ubuntu:24.04:LTS / node-browserslist

Package

Name: node-browserslist
Purl: pkg:deb/ubuntu/node-browserslist?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.21.4+~cs6.1.17-2

4.22.1+~cs6.1.28-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "4.22.1+~cs6.1.28-1",
            "binary_name": "node-browserslist"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73088.json"

Ubuntu:26.04:LTS / node-browserslist

Package

Name: node-browserslist
Purl: pkg:deb/ubuntu/node-browserslist?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.25.2+~cs6.3.22-1

4.26.0+~cs8.11.27-1

4.27.0+~cs8.11.53-2

4.28.1+~cs8.14.48-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "4.28.1+~cs8.14.48-1",
            "binary_name": "node-browserslist"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73088.json"