{
"id": "GHSA-qrmc-fj45-qfc2",
"aliases": [
"CVE-2018-16492"
],
"details": "Versions of `extend` prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution. The `extend()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nIf you're using `extend` 3.x upgrade to 3.0.2 or later.\nIf you're using `extend` 2.x upgrade to 2.0.2 or later.",
"summary": "Prototype Pollution in extend",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.2"
}
]
}
],
"package": {
"name": "extend",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.1.3"
},
{
"fixed": "2.0.2"
}
]
}
],
"package": {
"name": "extend",
"ecosystem": "npm"
}
}
],
"modified": "2026-01-22T21:48:14Z",
"severity": [],
"published": "2019-02-07T18:03:28Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16492",
"type": "ADVISORY"
},
{
"url": "https://github.com/github/advisory-database/pull/6695",
"type": "WEB"
},
{
"url": "https://github.com/justmoon/node-extend/pull/48",
"type": "WEB"
},
{
"url": "https://github.com/justmoon/node-extend/commit/0e68e71d93507fcc391e398bc84abd0666b28190",
"type": "WEB"
},
{
"url": "https://hackerone.com/reports/381185",
"type": "WEB"
},
{
"url": "https://github.com/justmoon/node-extend",
"type": "PACKAGE"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-06-16T21:52:44Z"
}
}