7.5 High

CVE-2023-26102 All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file…

Description

All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype

Affected products and versions

Product	Affected versions	Fixed in
rangy	Versions not published

Do you use rangy?

Track this CVE Watch rangy Check my SBOMs

www.cveye.io/en/cve/CVE-2023-26102

Timeline

Published February 24, 2023
Last modified March 11, 2025

References

security.snyk.io security.snyk.io
github.com github.com

Track this CVE