The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.
References:GSA_kwCzR0hTQS03cWdnLXZ3ODgtY2M5Oc4ABEK6
utils-extend Prototype Pollution
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| npm:utils-extend | <= 1.0.8 | No known fixed version | |
Affected Version RangesAll affected versions1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8 |
|||