CVE-2020-8147
CRITICALutils-extend < 1.0.8 - Prototype Pollution leading to Remote Code Execution or Denial of Service
Title source: llmDescription
Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/801522
Scores
CVSS v3
9.8
EPSS
0.0315
EPSS Percentile
86.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-20
CWE-471
Status
published
Products (2)
npm/utils-extend
0.0.0npm
utils-extend_project/utils-extend
< 1.0.8
Published
Apr 03, 2020
Tracked Since
Feb 18, 2026