CVE-2018-16489

9.8 criticalEPSS 1.8%

A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-400
Published: 2019-02-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

just-extend_project:just-extend

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-675m-85rw-j3w4	npm	just-extend	<4.0.0	4.0.0

References

https://hackerone.com/reports/430291
https://hackerone.com/reports/430291

Check your stack JSON