by Kastro
Paper/Archive/CVE-2023-26133

CVE-2023-26133

snyk — All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 69.6.696 × 2013.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.

Affected

ProductAffectedFixed inSource
progressbar.jsall versions–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refsecurity.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152refgithub.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20refgithub.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L18