CVE-2023-26133 progressbar.js vulnerable to Prototype Pollution
Prototype pollution in progressbar.js allows attackers to modify object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26133?
CVE-2023-26133 is a high-severity vulnerability in progressbar.js, published on 12 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.
Weakness: CWE-1321
Which versions are affected by CVE-2023-26133?
2 open source packages ship an affected version, including progressbar.js. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
progressbar.js npm | All versions | 1.1.1 |
progressbar.js npm | All versions | 1.1.1 |
Products include Progressbar.js Project Progressbar.js.
How do I fix CVE-2023-26133?
Upgrade progressbar.js to 1.1.1 or later.
Is CVE-2023-26133 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26133 exists.
Sources
Also known as GHSA-89qm-hm2x-mxm3, ROOT-APP-NPM-CVE-2023-26133.