CVE-2021-42581

CRITICAL Year: 2021
CVSS v3 Score
9.1
Critical
CVSS v2 Score
6.4
Medium
Weakness Type
CWE-1321
View all →

Vulnerability Description

Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes

Related Vulnerabilities

CVE-2019-10744

CRITICAL
CVSS:9.1(Critical)

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payl...

CWE-13212019

CVE-2021-27582

CRITICAL
CVSS:9.1(Critical)

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This ari...

CWE-13212021

CVE-2021-28860

CRITICAL
CVSS:9.1(Critical)

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to ...

CWE-13212021

CVE-2024-48910

CRITICAL
CVSS:9.1(Critical)

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

CWE-13212024

CVE-2024-57077

CRITICAL
CVSS:9.1(Critical)

The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or ...

CWE-13212024

CVE-2025-25014

CRITICAL
CVSS:9.1(Critical)

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

CWE-13212025