GHSA-fhv8-fx5f-7fxf
Prototype Pollution in the merge and clone helper methods
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2021-39227
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
### Impact Using `merge` and `clone` helper methods in the `src/core/util.ts` module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly. ### Patches It has been patched in https://github.com/ecomfe/zrender/pull/826. Users should update zrender to `5.2.1`. and update echarts to `5.2.1` if project is using echarts. ### References NA ### For more information NA
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · zrender | introduced 5.0.0, fixed 5.2.1 |
| npm · zrender | introduced 0, fixed 4.3.3 |
Références
- https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-39227 ADVISORY
- https://github.com/ecomfe/zrender/pull/826 WEB
- https://github.com/ecomfe/zrender PACKAGE
- https://github.com/ecomfe/zrender/releases/tag/5.2.1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |