Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify

HOCH 8.8CVE-2019-10808 · GHSA-9534-h433-2rjf · Published 11/03/2020 · updated 17/06/2026

Kurz gesagt

CVE-2019-10808 ist eine Schwachstelle (HOCH (CVSS 8.8)) in utilitify (xcritical.software), utilitify.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.0%, höher als bei 81.3% aller Schwachstellen.
Abhilfe: auf 1.0.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
utilitify xcritical.software	`< 1.0.3`	`1.0.3`
utilitify npm	`< 1.0.3`	`1.0.3`

Description

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.

NVD description

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.

References

nvd.nist.gov/vuln/detail/CVE-2019-10808 · ADVISORY
xcritical-software/utilitify commit 88d6e27 · WEB
snyk.io/vuln/SNYK-JS-UTILITIFY-559497 · WEB
xcritical-software/utilitify commit 88d6e27

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free