Executive brief
object-extend is a JavaScript utility library used to merge and extend objects. The library is vulnerable to prototype pollution, a technique that allows attackers to inject properties into all JavaScript objects, potentially leading to unexpected behavior, security bypass, or remote code execution depending on how the library is used in applications.
Technical details
The object-extend library versions 0.0.0 through 0.5.0 contain a prototype pollution vulnerability (CWE-1321) in the object merging logic. The flaw allows an attacker to inject malicious properties into the Object prototype by crafting specially-formed input with keys like "__proto__", "constructor", or "prototype". This vulnerability is network-reachable if the affected library is exposed to untrusted input (e.g., in a web application parsing user-supplied JSON). The impact ranges from denial of service to remote code execution depending on downstream code usage. No patch information is provided; users should upgrade to a version later than 0.5.0 if available or remove the dependency.
Affected products
- object-extend object-extend 0.0.0 through 0.5.0
Timeline
- 2022-02-19: disclosed