rangy vulnerable to Prototype Pollution
Date: 2023-02
Affected: npm/rangy
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-26102
CWE: CWE-1321
CVSS: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)

All versions of the package rangy are vulnerable to Prototype Pollution when using the `extend()` function in file `rangy-core.js`.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype.


Mitigations:

Architectural layers (MAESTRO):