| Package | Affected versions | Patched versions |
|---|---|---|
| fullpage | < 4.0.2 | 4.0.2 |
| fullpage.js | < 4.0.2 | 4.0.2 |
fullPage utils are available to developers using window.fp_utils. They can use these utils for their own use-case (other than fullPage) as well. However, one of the utils deepExtend is vulnerable to Prototype Pollution vulnerability.
Javascript is "prototype" language which means when a new "object" is created, it carries the predefined properties and methods of an "object" with itself like toString, constructor etc. By using prototype-pollution vulnerability, an attacker can overwrite/create the property of that "object" type. If the victim developer has used that property anywhere in the code, then it will have severe effect on the application.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free