CVE-2018-16492

CRITICAL

Extend < 2.0.2 - Denial of Service

Title source: rule

Description

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Exploits (1)

nomisec WRITEUP

by dsp-testing · poc

https://github.com/dsp-testing/CVE-2018-16492

View Code ZIP pw:eip

References (1)

[Exploit, Issue Tracking, Third Party Advisory] https://hackerone.com/reports/381185

Scores

CVSS v3 9.8

EPSS 0.0252

EPSS Percentile 85.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-74 CWE-400

Status published

Products (2)

extend_project/extend < 2.0.2

npm/extend 3.0.0 - 3.0.2npm

Published Feb 01, 2019

Tracked Since Feb 18, 2026