high8.2
CVE-2023-26102
rangy vulnerable to Prototype Pollution
Impact
All versions of the package rangy are vulnerable to Prototype Pollution when using the `extend()` function in file `rangy-core.js`.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | rangy | <= 1.3.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rangy Project | Rangy | All versions |