Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-16492. PoCs published by dsp-testing.
AI-analyzed exploit summary This repository is a legitimate Node.js utility library for object extension, not an exploit PoC. It contains no offensive techniques or vulnerability demonstrations.
Description
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
Exploits (1)
nomisec
WRITEUP
by dsp-testing · poc
https://github.com/dsp-testing/CVE-2018-16492
This repository is a legitimate Node.js utility library for object extension, not an exploit PoC. It contains no offensive techniques or vulnerability demonstrations.
Classification
Writeup 100%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target:
N/A
No auth needed
devstral-2 · analyzed Feb 16, 2026
Full analysis →
References (1)
Core 1
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/381185
Scores
CVSS v3
9.8
EPSS
0.0252
EPSS Percentile
85.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-74
CWE-400
Status
published
Products (2)
extend_project/extend
< 2.0.2
npm/extend
3.0.0 - 3.0.2npm
Published
Feb 01, 2019
Tracked Since
Feb 18, 2026