CVE-2023-26133 (published )
All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.