Prototype pollution attack through jQuery $.extend
Published: April 19, 2019
SECURITY IDENTIFIERS
- CVE: CVE-2019-11358 (NVD)
- GHSA: GHSA-6c3j-c64m-qhgq
- Vendor Advisory: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
GEM
FRAMEWORK
SEVERITY
PATCHED VERSIONS
>= 4.3.4
DESCRIPTION
jQuery before 3.4.0 mishandles jQuery.extend(true, {}, …) because of bject.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
