CVE-2018-16489 Prototype Pollution in just-extend
CriticalCVSS 9.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm just-extend(npm) | < 4.0.0 | 4.0.0 |
| just-extend project just-extend | < 4.0.0 | 4.0.0 |
| HackerOne just-extend | = <4.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- hackerone.com exploit issue-tracking third-party-advisory
- github.com
- www.npmjs.com