-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability documentation explicitly references the 'extend' function in babel.js and highlights the 'key' variable as the attack vector. Prototype pollution occurs when user-controlled keys are used to modify object properties without sanitization. The code references (lines 29165/29169) in steal's babel.js implementation likely correspond to property assignment operations in this extend() function. The lack of prototype pollution protections (like key allowlisting or hasOwnProperty checks) in these lines would make this function the primary vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| steal | npm | <= 2.3.0 |