GitHub Advisoryadvisory · npm

GHSA-fhv8-fx5f-7fxf Prototype Pollution in the merge and clone helper methods

MEDIUM Published 2021-09-20 Modified 2024-12-06 Official page ↗
Aliases
CVE-2021-39227
Ecosystem
npm
Packages
zrender
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-09-17

Affected packages

• npm zrender: >= 5.0.0, < 5.2.1 → fixed in 5.2.1 • npm zrender: < 4.3.3 → fixed in 4.3.3

Description

Impact Using `merge` and `clone` helper methods in the `src/core/util.ts` module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly. Patches It has been patched in https://github.com/ecomfe/zrender/pull/826. Users should update zrender to `5.2.1`. and update echarts to `5.2.1` if project is using echarts. References NA For more information NA

Related

Alias · CVE (1)

  • CVE-2021-39227 ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References