CVE-2023-26102 rangy vulnerable to Prototype Pollution
Prototype pollution in the rangy library allows attackers to modify Object.prototype, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-26102?
CVE-2023-26102 is a high-severity vulnerability in rangy, published on 24 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype
Weakness: CWE-1321
Which versions are affected by CVE-2023-26102?
2 open source packages ship an affected version, including rangy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rangy npm | All versions to 1.3.1 | None |
rangy npm | All versions to 1.3.1 | None |
Products include Rangy Project Rangy.
How do I fix CVE-2023-26102?
No fix has been published for CVE-2023-26102 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-26102 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26102 exists.
Sources
Also known as GHSA-65rp-mhqf-8gj3.