progressbar.js vulnerable to Prototype Pollution

Description

All versions of the package progressbar.js prior to 1.1.1 are vulnerable to Prototype Pollution via the function extend() in the file utils.js.

Recommendation

Update the progressbar.js package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.1
• Patched version(s): 1.1.1

References

• GHSA-89qm-hm2x-mxm3
• security.snyk.io
• CVE-2023-26133
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• rangy vulnerable to Prototype Pollution - CVE-2023-26102
• dot-lens vulnerable to Prototype Pollution - CVE-2023-26106
• Collection.js vulnerable to Prototype Pollution - CVE-2023-26113
• underscore-keypath vulnerable to Prototype Pollution - CVE-2023-26139

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

progressbar.js