CVE-2021-23402

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1321

Affected software

VendorProductVersions
n/arecord-like-deep-assign< unspecified

References

Timeline

Published
Jul 2, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-234039.8All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.CVE-2021-234048.8This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that theCVE-2021-234058.8This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the methodCVE-2021-234069.8This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:*CVE-2021-234077.5This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is useCVE-2021-234084.3This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked inCVE-2021-234097.5The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxyCVE-2021-23413.1Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that aCVE-2021-234116.1Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the main functionality. It accepts input that can result CVE-2021-234129.8All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to theCVE-2021-234135.3This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString,CVE-2021-234146.1This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
CVE-2021-23402: Critical severity, CVSS 9.8 | Vulnix