Executive brief
utils-extend is a JavaScript library used to merge object properties. A prototype pollution vulnerability allows attackers to inject malicious properties into the global object prototype chain by supplying specially crafted JSON payloads. This can cause application crashes (denial of service), and in certain configurations could enable arbitrary code execution if polluted properties reach sensitive Node.js APIs.
Technical details
The vulnerability is a Prototype Pollution flaw in the extend() function (lib/index.js:46) that fails to sanitize untrusted input before merging object properties. An attacker can supply a JSON payload with "__proto__" keys to modify Object.prototype properties in the global scope. The vulnerability requires no authentication and is triggered via a direct function call with a malicious object; successful exploitation results in pollution of the prototype chain, causing DoS at minimum. Depending on how polluted properties propagate within the application (e.g., to eval, exec, or other sensitive APIs), the impact may escalate to remote code execution. All versions up to and including 1.0.8 are affected.
Affected products
- utils-extend up to 1.0.8
Timeline
- 2024-12-10: disclosed
- 2025-02-06: advisory
- 2025-02-05: other: NVD published CVE-2024-57077