{"id":"CVE-2023-26133","aliases":["EUVD-2023-1747","GHSA-89qm-hm2x-mxm3","ROOT-APP-NPM-CVE-2023-26133"],"status":"published","title":"progressbar.js vulnerable to Prototype Pollution","description":"All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01261,"percentile":0.69875,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2023-06-12T05:00:01Z","modified":"2026-08-16T15:30:02Z","fixes":[{"ecosystem":"npm","package":"progressbar.js","fixed_in":["1.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"progressbar.js","fixed_in":["1.1.0-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/progressbar.js","fixed_in":["1.1.0-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"progressbar.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"progressbar.js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"progressbar.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/progressbar.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-root.io.4"}]}]}],"products":[{"vendor":"progressbar.js_project","product":"progressbar.js"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20","tags":["x_transferred","Broken Link"]},{"url":"https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L18","tags":["x_transferred","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26133","tags":["advisory"]},{"url":"https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js#L18","tags":["web"]},{"url":"https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js#L20","tags":["web"]},{"url":"https://github.com/kimmobrunfeldt/progressbar.js/commit/97fe68ef4beccfe84b7cba08ea1fc695e38cc04b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-89qm-hm2x-mxm3"},{"url":"https://github.com/kimmobrunfeldt/progressbar.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-26133","description":"All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.\r\r","status":"published","published":"2023-06-12T05:00:01.545Z","modified":"2025-01-06T17:03:38.87Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P","level":"high","assessor":"cna"}],"cwes":["CWE-1321","CWE-1321"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-1747","description":"All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.\r\r","status":"published","published":"2023-06-12T05:00:01Z","modified":"2025-01-06T17:03:38Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P","level":"high"}],"updated_at":"2026-11-03T00:04:25.578405Z"}],"ghsa":[{"id":"GHSA-89qm-hm2x-mxm3","title":"progressbar.js vulnerable to Prototype Pollution","description":"All versions of the package progressbar.js prior to 1.1.1 are vulnerable to Prototype Pollution via the function extend() in the file utils.js.\n\n","status":"published","published":"2023-06-12T06:30:17Z","modified":"2023-11-04T05:04:35Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:12.407027Z"}],"nvd":[{"id":"CVE-2023-26133","description":"All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.\r\r","status":"published","published":"2023-06-12T05:15:09.4Z","modified":"2026-06-17T05:42:45.08Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:08:05.329837Z"}],"osv":[{"id":"GHSA-89qm-hm2x-mxm3","title":"progressbar.js vulnerable to Prototype Pollution","description":"All versions of the package progressbar.js prior to 1.1.1 are vulnerable to Prototype Pollution via the function extend() in the file utils.js.\n\n","status":"published","published":"2023-06-12T06:30:17Z","modified":"2023-11-08T04:11:59.374308Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"ROOT-APP-NPM-CVE-2023-26133","title":"CVE-2023-26133 in progressbar.js - Patched by Root","description":"Root has patched CVE-2023-26133 in the progressbar.js package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-16T14:54:37Z","modified":"2026-08-16T15:30:02.6155447Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}