CRITICAL9.8

GHSA-g3vf-47fv-8f3c

MrSwitch hello.js vulnerable to prototype pollution

Quick fix

GHSA-g3vf-47fv-8f3c — hellojs: upgrade to the fixed version with the command below.

npm install hellojs@1.18.8

Details

A prototype pollution vulnerability in MrSwitch hello.js prior to version 1.18.8 allows remote attackers to execute arbitrary code via `hello.utils.extend` function.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/hellojs

Introduced in: 0Fixed in: 1.18.8

Fixnpm install hellojs@1.18.8

References

https://nvd.nist.gov/vuln/detail/CVE-2021-26505[ADVISORY]
https://github.com/MrSwitch/hello.js/issues/634[WEB]
https://github.com/MrSwitch/hello.js/commit/7ab50aeff2d41991f08d4ad6c0481125eea8f6b7[WEB]
https://github.com/MrSwitch/hello.js[PACKAGE]