Prototype Pollution Vulnerability in node-extend
Summary
CVE-2018-16492: A prototype pollution vulnerability was found in module extend. Affects node-extend versions < 3.0.2-1. Fixed in 3.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
node-extend is a package in the Debian ecosystem that provides a set of utility functions for extending objects. It allows developers to add properties and methods to existing objects. However, a vulnerability has been discovered in versions prior to 3.0.2-1 that allows an attacker to inject arbitrary properties onto Object.prototype.
Vulnerability Detail
The vulnerability, known as CVE-2018-16492, is a prototype pollution vulnerability. It occurs when untrusted user input is used to modify the prototype of an object. In the case of node-extend, an attacker can exploit this vulnerability to inject arbitrary properties onto Object.prototype. This can lead to various security issues, such as the ability to overwrite existing properties or execute arbitrary code.
How To Fix
Minimum fixed version
3.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-extendTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version as soon as possible.
Conclusion
In conclusion, the node-extend package in the Debian ecosystem is vulnerable to a prototype pollution vulnerability. It is recommended to update the package to version 3.0.2-1 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for node-extend →
FAQ
Prototype pollution is a vulnerability that occurs when untrusted user input is used to modify the prototype of an object. This can lead to various security issues, such as the ability to overwrite existing properties or execute arbitrary code.
An attacker can exploit this vulnerability by injecting arbitrary properties onto Object.prototype using the node-extend package. This can lead to security issues such as property overwriting or arbitrary code execution.
Yes, a fix is available for this vulnerability. It is recommended to update node-extend to version 3.0.2-1 or later.
Yes, all versions of node-extend prior to 3.0.2-1 are affected by this vulnerability.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity.
Related vulnerabilities
Recent vulnerabilities recorded for node-extend.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
