high8.2
CVE-2023-26133
progressbar.js vulnerable to Prototype Pollution
Impact
All versions of the package progressbar.js prior to 1.1.1 are vulnerable to Prototype Pollution via the function extend() in the file utils.js.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | progressbar.js | < 1.1.1 | 1.1.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Progressbar.Js Project | Progressbar.Js | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L18
- https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20
- https://security.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152
- https://github.com/advisories/GHSA-89qm-hm2x-mxm3
- https://nvd.nist.gov/vuln/detail/CVE-2023-26133
- https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js#L18
- https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js#L20
- https://github.com/kimmobrunfeldt/progressbar.js/commit/97fe68ef4beccfe84b7cba08ea1fc695e38cc04b