Executive brief
js-extend is a JavaScript utility library that provides an object merging function. A prototype pollution vulnerability in versions 0.0.1 through 1.0.1 allows attackers to manipulate the JavaScript object prototype, potentially causing denial of service or enabling remote code execution in applications that use this library to process untrusted data.
Technical details
This is a prototype pollution vulnerability (CWE-1321, CWE-915) affecting js-extend's extend() function in versions 0.0.1 through 1.0.1. The vulnerability occurs because the function does not properly validate or sanitize object properties during the merge operation, allowing an attacker to inject malicious properties into the Object prototype. An attacker can exploit this by crafting a specially formatted input object containing constructor or __proto__ properties. No authentication or user interaction is required; the attack is triggered when the extend function processes attacker-controlled input. The vulnerability can lead to denial of service or remote code execution depending on how the polluted prototype is used downstream. Patching involves upgrading to a version beyond 1.0.1 or implementing strict input validation.
Affected products
- js-extend js-extend 0.0.1 through 1.0.1
Timeline
- 2021-05-26: disclosed: NVD published vulnerability
- 2021-06-08: advisory: GHSA advisory published