Description

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.

Remediation

References

https://github.com/eggjs/extend2/blob/master/index.js%23L50-L60

https://github.com/eggjs/extend2/commit/aa332a59116c8398976434b57ea477c6823054f8

https://github.com/eggjs/extend2/pull/2

https://snyk.io/vuln/SNYK-JS-EXTEND2-2320315

Related Vulnerabilities

CVE-2020-14062 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2022-3171 Vulnerability in maven package com.google.protobuf:protobuf-kotlin-lite

CVE-2020-36732 Vulnerability in maven package org.webjars.npm:crypto-js

CVE-2022-24728 Vulnerability in npm package ckeditor4

CVE-2021-4306 Vulnerability in npm package terminal-kit

Severity

Critical

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Patch Third Party Advisory Issue Tracking Exploit