Prototype Pollution Vulnerability in 'extend' Module by Vendor
CVE-2018-16492
9.8CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2018-16492?
The 'extend' module versions prior to 2.0.2 and those less than 3.0.2 contain a vulnerability that permits attackers to inject arbitrary properties into Object.prototype. This type of prototype pollution can be exploited to manipulate the behavior of applications that rely on this module, potentially leading to severe security implications and unintended data exposure.
Affected Version(s)
extend < 2.0.2, ~<3.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.