CVE-2019-11358

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution

published April 19, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.7th percentile for exploit probability.

CVSS
—
EPSS
87%
Percentile
99.7
In the wild
Unconfirmed
What it is

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.86820 · 99.7th percentile
Published
2019-04-19T00:00Z
EPSS history
Timeline
  • 19 APR 00:00Z
    jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution
    cvelistv5