CVE-2023-26102

All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype

• CWE-1321
• CWE-1321
• CWE-1321

• https://github.com/timdown/rangy/issues/478Exploit, Issue Tracking, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702Exploit, Third Party Advisory
• https://github.com/timdown/rangy/issues/478Exploit, Issue Tracking, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702Exploit, Third Party Advisory

Published

Feb 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26097An issue was discovered in Telindus Apsal 3.14.2022.235 b. U…5.5
• CVE-2023-26098An issue was discovered in the Open Document feature in Teli…7.8
• CVE-2023-26099An issue was discovered in Telindus Apsal 3.14.2022.235 b. T…7.1
• CVE-2023-2610Integer Overflow or Wraparound in GitHub repository vim/vim …7.8
• CVE-2023-26100In Progress Flowmon before 12.2.0, an application endpoint f…6.1
• CVE-2023-26101In Progress Flowmon Packet Investigator before 12.1.0, a Flo…7.5
• CVE-2023-26103Versions of the package deno before 1.31.0 are vulnerable to…7.5
• CVE-2023-26104All versions of the package lite-web-server are vulnerable t…7.5
• CVE-2023-26105All versions of the package utilities are vulnerable to Prot…7.5
• CVE-2023-26106All versions of the package dot-lens are vulnerable to Proto…7.5
• CVE-2023-26107All versions of the package sketchsvg are vulnerable to Arbi…7.8
• CVE-2023-26108Versions of the package @nestjs/core before 9.0.5 are vulner…5.3