CVE-2018-16492 Prototype Pollution in extend
Attackers can inject arbitrary properties into Object.prototype via prototype pollution in the extend library, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16492?
CVE-2018-16492 is a critical code injection vulnerability in HackerOne extend, published on 1 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
Which versions are affected by CVE-2018-16492?
4 open source packages ship an affected version, including extend. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
extend npm | From 1.1.3 | 2.0.2 |
extend npm | From 1.1.3 | 2.0.2 |
extend npm | From 3.0.0 | 3.0.2 |
extend npm | From 3.0.0 | 3.0.2 |
Products include Extend Project Extend.
How do I fix CVE-2018-16492?
Upgrade extend to a fixed version for your release line: 2.0.2 or 3.0.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-16492 being exploited?
There is no known exploitation of CVE-2018-16492 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLSA-2026-1773188141, DEBIAN-CVE-2018-16492, GHSA-qrmc-fj45-qfc2, UBUNTU-CVE-2018-16492.