MrSwitch hello.js vulnerable to prototype pollution

严重 9.8CVE-2021-26505 · GHSA-g3vf-47fv-8f3c · Published 11/08/2023 · updated 17/06/2026

要点

CVE-2021-26505 是影响 hello.js (hello.js project), hellojs 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.1%，高于 66.9% 的漏洞。
修复：升级到 1.18.8 或更高版本。

Package	Affected versions	Patched versions
hello.js hello.js_project	`= 1.18.6`	No fix yet
hellojs npm	`< 1.18.8`	`1.18.8`

Description

A prototype pollution vulnerability in MrSwitch hello.js prior to version 1.18.8 allows remote attackers to execute arbitrary code via hello.utils.extend function.

NVD description

Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.

References

nvd.nist.gov/vuln/detail/CVE-2021-26505 · ADVISORY
MrSwitch/hello.js · WEB
MrSwitch/hello.js commit 7ab50ae · WEB
MrSwitch/hello.js · PACKAGE

hello.js 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free