CVE-2023-26133
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Jun 12, 2023
Updated: Jan 6, 2025
CWE ID 1321
Summary
CVE-2023-26133 is a prototype pollution vulnerability affecting all versions of the progressbar.js package. The issue lies within the 'extend()' function found in the 'utils.js' file, which can be manipulated to inject malicious code and alter the behavior of progressbar.js objects. Attackers can leverage this vulnerability to gain unintended control over the application, potentially leading to data breaches or unauthorized functionality. It is recommended that users upgrade to the latest version of progressbar.js to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.