Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify

HIGH 8.8CVE-2019-10808 · GHSA-9534-h433-2rjf · Published 11/03/2020 · updated 17/06/2026

In short

CVE-2019-10808 is a HIGH (CVSS 8.8) vulnerability affecting utilitify (xcritical.software), utilitify.
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.3% of all vulnerabilities.
Fix: update to 1.0.3 or later.

Package	Affected versions	Patched versions
utilitify xcritical.software	`< 1.0.3`	`1.0.3`
utilitify npm	`< 1.0.3`	`1.0.3`

Description

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.

NVD description

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.

References

nvd.nist.gov/vuln/detail/CVE-2019-10808 · ADVISORY
xcritical-software/utilitify commit 88d6e27 · WEB
snyk.io/vuln/SNYK-JS-UTILITIFY-559497 · WEB
xcritical-software/utilitify commit 88d6e27

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free