CVE-2023-26158

All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). User controlled inputs inside the extend() method of the Mock.Handler, Mock.Random, Mock.RE.Handler or Mock.Util, will allow an attacker to exploit this vulnerability. Workaround By using a denylist of dangerous attributes, this weakness can be eliminated. Add the following line in the Util.extend function: js js if (["__proto__", "constructor", "prototype"].includes(name)) continue js // src/mock/handler.js Util.extend = function extend() { var target = arguments[0] || {}, i = 1, length = arguments.length, options, name, src, copy, clone if (length === 1) { target = this i = 0 } for (; i < length; i++) { options = arguments[i] if (!options) continue for (name in options) { if (["__proto__", "constructor", "prototype"].includes(name)) continue src = target[name] copy = options[name] if (target === copy) continue if (copy === undefined) continue if (Util.isArray(copy) || Util.isObject(copy)) { if (Util.isArray(copy)) clone = src && Util.isArray(src) ? src : [] if (Util.isObject(copy)) clone = src && Util.isObject(src) ? src : {} target[name] = Util.extend(clone, copy) } else { target[name] = copy } } } return target }

• CWE-1321
• CWE-1321

• https://github.com/nuysoft/Mock/blob/00ce04b92eb464e664a4438430903f2de96efb47/dist/mock.js%23L721-L755Broken Link
• https://security.snyk.io/vuln/SNYK-JS-MOCKJS-6051365Exploit, Mitigation, Third Party Advisory
• https://github.com/nuysoft/Mock/blob/00ce04b92eb464e664a4438430903f2de96efb47/dist/mock.js%23L721-L755Broken Link
• https://security.snyk.io/vuln/SNYK-JS-MOCKJS-6051365Exploit, Mitigation, Third Party Advisory

Published

Dec 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26152All versions of the package static-server are vulnerable to …7.5
• CVE-2023-26153Versions of the package geokit-rails before 2.5.0 are vulner…9.8
• CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of…5.9
• CVE-2023-26155All versions of the package node-qpdf are vulnerable to Comm…9.8
• CVE-2023-26156Versions of the package chromedriver before 119.0.1 are vuln…7.5
• CVE-2023-26157Versions of the package libredwg before 0.12.5.6384 are vuln…7.5
• CVE-2023-26159Versions of the package follow-redirects before 1.15.4 are v…6.1
• CVE-2023-2616Cross-site Scripting (XSS) - Generic in GitHub repository pi…5.4
• CVE-2023-2617A vulnerability classified as problematic was found in OpenC…7.5
• CVE-2023-2618A vulnerability, which was classified as problematic, has be…7.5
• CVE-2023-2619A vulnerability, which was classified as critical, was found…9.8
• CVE-2023-2620An issue has been discovered in GitLab CE/EE affecting all v…3.8