CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HCVE-2023-26102
High (8.2) in rangy project rangy. EPSS 0.8% chance of exploitation in the next 30 days.
All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rangy_project:rangy
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-65rp-mhqf-8gj3 | npm | rangy | <=1.3.1 | no fix published |