Fix Prototype Pollution vulnerability (CVE-2023-26102) [security]

timdown / rangy

A cross-browser JavaScript range and selection library.

MIT License

2.24k stars 368 forks source link

Fix Prototype Pollution vulnerability (CVE-2023-26102) [security] #482

Open JordiVM opened 1 year ago

JordiVM commented 1 year ago

fixes #481

Rangy was flagged with Prototype Pollution vulnerability at the end of 2022. This PR proposes a solution by skipping the problematic object attributes in rangy.util.extend()

marcbachmann commented 1 year ago

@timdown feel free to add me as maintainer here and on npm if you don't have the time to maintain this module. Then we can at least get the security issues fixed.

antonh-ne commented 1 year ago

suggestion:

People aware of this vulnerability can patch it themselves for now, until a fix has been merged.

Talendar commented 1 month ago

@timdown, please, merge the fix and accept new maintainers.