Prototype Pollution in just-extend

CRITICAL 9.8CVE-2018-16489 · GHSA-675m-85rw-j3w4 · Published 01/02/2019 · updated 17/06/2026

In short

CVE-2018-16489 is a CRITICAL (CVSS 9.8) vulnerability affecting just-extend (just-extend project), just-extend.
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 79.1% of all vulnerabilities.
Fix: update to 4.0.0 or later.

Package	Affected versions	Patched versions
just-extend just-extend_project	`< 4.0.0`	`4.0.0`
just-extend npm	`< 4.0.0`	`4.0.0`

Description

Versions of just-extend before 4.0.0 are vulnerable to prototype pollution. Provided certain input just-extend can add or modify properties of the Object prototype. These properties will be present on all objects.

Recommendation

Update to version 4.0.0 or later.

NVD description

A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.

References

nvd.nist.gov/vuln/detail/CVE-2018-16489 · ADVISORY
hackerone.com/reports/430291 · WEB
GitHub Advisory GHSA-675m-85rw-j3w4 · ADVISORY
npmjs.com/advisories/780 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free