Description

All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.

Remediation

References

https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L18

https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20

https://security.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152

Related Vulnerabilities

CVE-2021-23387 Vulnerability in npm package trailing-slash

CVE-2023-22578 Vulnerability in npm package sequelize

CVE-2023-24057 Vulnerability in maven package org.hl7.fhir.publisher:org.hl7.fhir.publisher.core

CVE-2019-10754 Vulnerability in maven package org.apereo.cas:cas-server-support-simple-mfa

CVE-2018-16486 Vulnerability in npm package defaults-deep

Severity

Critical

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Third Party Advisory