PT-2023-20489 · Rangy · Rangy

Peng Zhou + 1 · Published 2023-02-24 · Updated 2025-03-11 · CVE-2023-26102

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions rangy versions all

Description The issue concerns Prototype Pollution in the rangy package. It occurs when using the extend() function in the file rangy-core.js, which utilizes a recursive merge. This can allow an attacker to modify properties of the Object.prototype.

Recommendations For all versions, consider disabling the extend() function in rangy-core.js as a temporary workaround until a patch is available. Restrict access to the rangy-core.js file to minimize the risk of exploitation. Avoid using the extend() function in the affected file until the issue is resolved.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2023-26102

GHSA-65RP-MHQF-8GJ3

Affected Products

Rangy

References · 9

• 🔥 https://github.com/timdown/rangy/issues/478 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702 · Exploit
• https://osv.dev/vulnerability/GHSA-65rp-mhqf-8gj3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26102 · Security Note
• https://github.com/timdown/rangy · Note
• https://t.me/cvenotify/114253 · Telegram Post
• https://t.me/cibsecurity/58842 · Telegram Post
• https://t.me/cvenotify/44874 · Telegram Post