CVE-2021-39227

Katalog CVE

CVSS 9.8 · Critical EPSS 1,4%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada baidu zrender. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.

Rincian

Terbit di NVD

17 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ecomfe/zrender/pull/826 patch · advisory pihak ketiga
• https://github.com/ecomfe/zrender/releases/tag/5.2.1 release notes · advisory pihak ketiga
• https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf advisory pihak ketiga