Description
All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype
Remediation
References
https://github.com/timdown/rangy/issues/478
https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702
Related Vulnerabilities
CVE-2017-1000427 Vulnerability in maven package org.webjars:marked
CVE-2023-26122 Vulnerability in npm package safe-eval
CVE-2022-25927 Vulnerability in maven package org.webjars.bowergithub.faisalman:ua-parser-js
CVE-2020-7787 Vulnerability in npm package react-adal
CVE-2023-22621 Vulnerability in npm package @strapi/plugin-users-permissions