CVE-2021-23397

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Jul 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-233986.1All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is trig CVE-2021-233999.8This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for a CVE-2021-23402.7Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions that are affected are 8.0.25 an CVE-2021-234008.8The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage CVE-2021-234016.1This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect CVE-2021-234029.8All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.CVE-2021-234039.8All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.CVE-2021-234048.8This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the CVE-2021-234058.8This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method CVE-2021-234069.8This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:*CVE-2021-234077.5This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is use CVE-2021-234084.3This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked in