Description
All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype
Remediation
References
https://github.com/timdown/rangy/issues/478
https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702
Related Vulnerabilities
CVE-2022-26112 Vulnerability in maven package org.apache.pinot:pinot-spi
CVE-2022-36036 Vulnerability in npm package mdx-mermaid
CVE-2023-22621 Vulnerability in npm package @strapi/plugin-users-permissions
CVE-2022-36886 Vulnerability in maven package org.jenkins-ci.plugins:external-monitor-job
CVE-2013-6235 Vulnerability in maven package com.jamonapi:jamon