CVE-2021-23426

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Sep 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-234279.8This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction CVE-2021-234289.8This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing CVE-2021-234297.5All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled wit CVE-2021-23434.3Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that a CVE-2021-234307.5All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.CVE-2021-234318.8The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.CVE-2021-234329.8This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()CVE-2021-234339.8The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters CVE-2021-234348.6This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path comp CVE-2021-234356.1This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_t CVE-2021-234369.8This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided ke CVE-2021-234377.5The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.