CVE-2021-26505

CRITICAL9.8EPSS 1.7%

MrSwitch hello.js vulnerable to prototype pollution

Published: 8/11/2023Modified: 11/8/2023

Description

A prototype pollution vulnerability in MrSwitch hello.js prior to version 1.18.8 allows remote attackers to execute arbitrary code via `hello.utils.extend` function.

Affected packages (1)

npm/hellojsfrom 0, < 1.18.8

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-26505
PATCHhttps://github.com/MrSwitch/hello.js
WEBhttps://github.com/MrSwitch/hello.js/commit/7ab50aeff2d41991f08d4ad6c0481125eea8f6b7
WEBhttps://github.com/MrSwitch/hello.js/issues/634