Critical · 9.8 CVE-2021-26505 EUVD-2023-2286GHSA-g3vf-47fv-8f3c

MrSwitch hello.js vulnerable to prototype pollution

Published Aug 11, 2023 · Updated Oct 9, 2024 · Assigned by mitre

Description

Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	hellojs	< 1.18.8	1.18.8	GHSA-g3vf-47fv-8f3c

References

https://github.com/MrSwitch/hello.js/issues/634