What’s Vulnerable › Vulnerabilities

CVE-2023-26133

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-12 · updated 2026-06-17
• Weakness: CWE-1321

Description

All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.

Affected products

• progressbar.js: all versions

References

• https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L18
• https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20
• https://security.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152
• https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L18
• https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20
• https://security.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152

Get alerted when CVE-2023-26133 or the next vulnerability affects your stack