Prototype Pollution

CRITICAL 9.8CVE-2020-8147 · GHSA-6pq3-928q-x6w6 · Published 03/04/2020 · updated 17/06/2026

In short

CVE-2020-8147 is a CRITICAL (CVSS 9.8) vulnerability affecting utils-extend (utils-extend project), utils-extend.
Chance of exploitation in the next 30 days (EPSS): 3.1%, higher than 88.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
utils-extend utils-extend_project	`≤ 1.0.8`	No fix yet
utils-extend npm	`≥ 0.0.0`	No fix yet

Description

All versions of utils-extend are vulnerable to prototype pollution. The extend function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

NVD description

Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend.

References

nvd.nist.gov/vuln/detail/CVE-2020-8147 · ADVISORY
hackerone.com/reports/801522 · WEB
npmjs.com/advisories/1502 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free