PT-2019-9313 · Node.Js · Node-Extend

Asgerf · Published 2019-02-01 · Updated 2019-10-09 · CVE-2018-16491

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions node.extend versions prior to 1.1.7 node.extend versions prior to 2.0.1

Description A prototype pollution issue was discovered in node.extend that allows an attacker to inject arbitrary properties onto Object.prototype.

Recommendations Update to version 1.1.7 or later. Update to version 2.0.1 or later.

Exploit

Fix

Special Elements Injection

Resource Exhaustion

Weakness Enumeration

CWE-74

CWE-400

Related Identifiers

CVE-2018-16491

GHSA-R96C-57PF-9JJM

Affected Products

Node-Extend

References · 11

• 🔥 https://hackerone.com/reports/430831 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16491 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16491 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16491 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16491 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16491 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16491 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-16491 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r96c-57pf-9jjm · Vendor Advisory
• https://npmjs.com/advisories/781 · Note
• https://github.com/advisories/GHSA-r96c-57pf-9jjm · Note