CVE-2021-25945: Prototype Pollution Vulnerability in js-extend
Summary
CVE-2021-25945: Prototype pollution vulnerability in js-extend. Affects js-extend versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'js-extend' package is an npm package that provides a set of utility functions for extending JavaScript objects. It allows developers to easily add or modify properties and methods of existing objects. The package is widely used in JavaScript applications for object manipulation and extension. However, versions 0.0.1 through 1.0.1 of 'js-extend' are vulnerable to a prototype pollution vulnerability.
Vulnerability Detail
The prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows an attacker to manipulate the prototype of an object, leading to a denial of service and potentially remote code execution. By injecting malicious values into the prototype of an object, an attacker can modify the behavior of the application and potentially execute arbitrary code. This vulnerability poses a significant risk to applications that use 'js-extend' and are not properly validating and sanitizing user input.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the 'js-extend' package to a non-vulnerable version as soon as possible.
Conclusion
The 'js-extend' package versions 0.0.1 through 1.0.1 are vulnerable to a prototype pollution vulnerability that can lead to denial of service and potential remote code execution. It is crucial for developers to update their application's dependencies to use a non-vulnerable version of 'js-extend', such as 1.0.2 or later. Additionally, it is recommended to regularly check for vulnerabilities in your application using tools like Vulert to ensure the security of your software.
See every vulnerability recorded for js-extend →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker is able to modify the prototype of an object. By manipulating the prototype, the attacker can modify the behavior of the application and potentially execute arbitrary code.
Applications that use the vulnerable versions of 'js-extend' are at risk of denial of service and potential remote code execution. Attackers can exploit this vulnerability by injecting malicious values into the prototype of an object, leading to unexpected behavior and potential security breaches.
No, only versions 0.0.1 through 1.0.1 of 'js-extend' are affected by this vulnerability. It is recommended to update to a non-vulnerable version, such as 1.0.2 or later.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing this vulnerability in your application.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
