1024bit extend-deep index.js prototype pollution_CVE-2026-6621

6.9 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Description

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument __proto__ causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.

Basic Information

ID CVE-2026-6621

Source VulDB

Published Apr 20, 2026 at 08:30

Affected Product

Vendor 1024bit

Product extend-deep

Version 0.1.0

Affected Versions 1024bit extend-deep 0.1.0
1024bit extend-deep 0.1.1
1024bit extend-deep 0.1.2
1024bit extend-deep 0.1.3
1024bit extend-deep 0.1.4
1024bit extend-deep 0.1.5
1024bit extend-deep 0.1.6

CWE Classification

CWE-1321 CWE-94

References

{
    "lastseen": "",
    "description": "A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument __proto__ causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.",
    "published": "2026-04-20T08:30:14.457Z",
    "modified": "2026-04-20T08:30:14.457Z",
    "type": "cve",
    "title": "1024bit extend-deep index.js prototype pollution",
    "source": "VulDB",
    "references": "https://vuldb.com/vuln/358256\nhttps://vuldb.com/vuln/358256/cti\nhttps://vuldb.com/submit/792387\nhttps://github.com/sudo-secure/security-research/blob/main/extend-deep/prototype-pollution/PoC.md",
    "id": "CVE-2026-6621",
    "bulletinFamily": "",
    "cwe": [
        "CWE-1321",
        "CWE-94"
    ],
    "cvelist": null,
    "sourceData": "1024bit extend-deep 0.1.0\n1024bit extend-deep 0.1.1\n1024bit extend-deep 0.1.2\n1024bit extend-deep 0.1.3\n1024bit extend-deep 0.1.4\n1024bit extend-deep 0.1.5\n1024bit extend-deep 0.1.6",
    "sourceHref": "",
    "cvss": {
        "score": 6.9,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "extend-deep",
    "version": "0.1.0",
    "vendor": "1024bit",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}