{"id":"CVE-2023-26113","aliases":["EUVD-2023-0860","GHSA-47pj-q2vm-46xc"],"status":"published","title":"Collection.js vulnerable to Prototype Pollution","description":"Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0122,"percentile":0.69066,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2023-03-18T05:00:01Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"npm","package":"collection.js","fixed_in":["6.8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"collection.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1"}]}]},{"source":"osv","ecosystem":"npm","package":"collection.js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.8.1"}]}]}],"products":[{"vendor":"collection.js_project","product":"collection.js"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-COLLECTIONJS-3185148","tags":["x_transferred","Exploit","Technical Description","Third Party Advisory","web"]},{"url":"https://github.com/kobezzza/Collection/issues/27","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1ab8ff1d2d19c/dist/node/iterators/extend.js%23L324","tags":["x_transferred","Broken Link","web"]},{"url":"https://github.com/kobezzza/Collection/releases/tag/v6.8.1","tags":["x_transferred","Patch","Release Notes","web"]},{"url":"https://github.com/kobezzza/Collection/commit/d3d937645f62f37d3115d6aa90bb510fd856e6a2","tags":["x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26113","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-47pj-q2vm-46xc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26113.json","tags":["advisory"]},{"url":"https://github.com/kobezzza/Collection","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-26113","description":"Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js. \r\r","status":"published","published":"2023-03-18T05:00:01.243Z","modified":"2025-02-26T17:12:06.093Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-0860","description":"Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js. \r\r","status":"published","published":"2023-03-18T05:00:01Z","modified":"2025-02-26T17:12:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","level":"high"}],"updated_at":"2026-11-02T20:53:23.257772Z"}],"ghsa":[{"id":"GHSA-47pj-q2vm-46xc","title":"Collection.js vulnerable to Prototype Pollution","description":"Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the `extend` function in `Collection.js/dist/node/iterators/extend.js`.","status":"published","published":"2023-03-18T06:30:15Z","modified":"2023-11-29T00:00:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:22.840002Z"}],"nvd":[{"id":"CVE-2023-26113","description":"Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js. \r\r","status":"published","published":"2023-03-18T05:15:52.937Z","modified":"2026-06-17T05:42:42.327Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:07:49.031498Z"}],"osv":[{"id":"CVE-2023-26113","description":"Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js. \r\r","status":"published","published":"2023-03-18T05:00:01.243Z","modified":"2026-10-28T02:31:09.259229986Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"GHSA-47pj-q2vm-46xc","title":"Collection.js vulnerable to Prototype Pollution","description":"Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the `extend` function in `Collection.js/dist/node/iterators/extend.js`.","status":"published","published":"2023-03-18T06:30:15Z","modified":"2023-11-08T04:11:58.319386Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}