Description
All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 1.1.0
References
Could your website be exposed too?
SmartScanner can check your website for mockjs vulnerable to Prototype Pollution via the Util.extend function and gives you actionable findings to investigate.
Start a free scanRelated Issues
- progressbar.js vulnerable to Prototype Pollution - CVE-2023-26133
- dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() - CVE-2026-27837
- jsonic was discovered to contain a prototype pollution via the function empty. - CVE-2024-38993
- akbr patch-into was discovered to contain a prototype pollution via the function patchInto - CVE-2024-38991
You might also like:
See something that needs correcting? Let us knowUpdated December 17, 2023