Description
A prototype pollution vulnerability in MrSwitch hello.js prior to version 1.18.8 allows remote attackers to execute arbitrary code via hello.utils.extend function.
Recommendation
Update the hellojs package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.18.8
- Patched version(s): 1.18.8
References
Could your website be exposed too?
SmartScanner can check your website for MrSwitch hello.js vulnerable to prototype pollution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- json-schema is vulnerable to Prototype Pollution - CVE-2021-3918
- jszip Vulnerable to Prototype Pollution - CVE-2021-23413
- merge vulnerable to Prototype Pollution - CVE-2021-3645
- npm package rfc6902 vulnerable to Prototype Pollution - CVE-2021-4245
You might also like:
See something that needs correcting? Let us knowUpdated November 09, 2023