CVE-2023-26113: collection.js project collection.js

csirt@kutim:~/threat-intel/cve/CVE-2023-26113

CVSS 7.5 · High EPSS 1,2%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada collection.js project collection.js. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.

Rincian

Terbit di NVD: 18 Maret 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 67,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
collection.js project	collection.js	Semua versi sebelum 6.8.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/kobezzza/Collection/commit/d3d937645f62f37d3115d6aa90bb510fd856e6a2 patch
https://github.com/kobezzza/Collection/issues/27 exploit · issue tracking · patch · advisory pihak ketiga
https://github.com/kobezzza/Collection/releases/tag/v6.8.1 patch · release notes
https://security.snyk.io/vuln/SNYK-JS-COLLECTIONJS-3185148 exploit · deskripsi teknis · advisory pihak ketiga
https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1ab8ff1d2d19c/dist/node/iterators/exten... broken link

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.