CVE-2021-26505: Hello.js Project Hello.js

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.

Affected products

• Hello.js Project Hello.js: version 1.18.6 only

Published 2023-08-11. Last modified 2026-06-17.