Home > Vulnerability Database > CVE-2023-26133

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2023-26133

Good to know:

Date: June 12, 2023

All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.

Language: JS

Severity Score

8.2

Related Resources (8)

Url: https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js#L20

Url: https://github.com/kimmobrunfeldt/progressbar.js

Url: https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js#L18

Url: https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L18

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-26133

Url: https://github.com/kimmobrunfeldt/progressbar.js/commit/97fe68ef4beccfe84b7cba08ea1fc695e38cc04b

Url: https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20

Url: https://www.mend.io/vulnerability-database/CVE-2023-26133

Severity Score

8.2

Weakness Type (CWE)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

Upgrade Version

Upgrade to version progressbar.js - 1.1.1;progressbar.js - 1.1.1

CVSS v3.1

Base Score:	8.2
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	HIGH
Availability (A):	LOW

Do you need more information?

Contact Us