Skip to content

Prototype Pollution in extend

Moderate severity GitHub Reviewed Published Feb 7, 2019 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm extend (npm)

Affected versions

>= 3.0.0, < 3.0.2
< 2.0.2

Patched versions

3.0.2
2.0.2

Description

Versions of extend prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution. The extend() function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.

Recommendation

If you're using extend 3.x upgrade to 3.0.2 or later.
If you're using extend 2.x upgrade to 2.0.2 or later.

References

Published to the GitHub Advisory Database Feb 7, 2019
Reviewed Jun 16, 2020
Last updated Jan 9, 2023

Severity

Moderate

EPSS score

0.390%
(74th percentile)

Weaknesses

CVE ID

CVE-2018-16492

GHSA ID

GHSA-qrmc-fj45-qfc2

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.