CVE-2018-16492: Extend Project Extend

Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days.

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Affected products

• Extend Project Extend: before 2.0.2 (fixed in 2.0.2); from 3.0.0, before 3.0.2 (fixed in 3.0.2)

Published 2019-02-01. Last modified 2026-06-17.