Vulnerability Details : CVE-2021-39227
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.
Products affected by CVE-2021-39227
- cpe:2.3:a:baidu:zrender:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-39227
0.34%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 71 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-39227
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
6.2
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
2.5
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2021-39227
-
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
References for CVE-2021-39227
-
https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf
Prototype Pollution in zrender · Advisory · ecomfe/zrender · GitHubThird Party Advisory
-
https://github.com/ecomfe/zrender/releases/tag/5.2.1
Release 5.2.1 · ecomfe/zrender · GitHubRelease Notes;Third Party Advisory
-
https://github.com/ecomfe/zrender/pull/826
fix prototype pollution in merge, clone, extend utilities by pissang · Pull Request #826 · ecomfe/zrender · GitHubPatch;Third Party Advisory
Jump to