Description

All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.

Remediation

References

https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L18

https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20

https://security.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152

Related Vulnerabilities

CVE-2022-25345 Vulnerability in npm package @discordjs/opus

CVE-2022-43420 Vulnerability in maven package org.jenkins-ci.plugins:contrast-continuous-application-security

CVE-2020-36649 Vulnerability in maven package org.webjars.bower:papaparse

CVE-2020-9483 Vulnerability in maven package org.apache.skywalking:server-storage-plugin

CVE-2020-7609 Vulnerability in npm package node-rules

Severity

Critical

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Third Party Advisory