CVE-2021-23444

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
n/a	jointjs	>= unspecified, < 3.4.2

References

https://github.com/clientIO/joint/commit/e5bf89efef6d5ea572d66870ffd86560de7830a8Patch, Third Party Advisory
https://github.com/clientIO/joint/pull/1514Third Party Advisory
https://github.com/clientIO/joint/releases/tag/v3.4.2Release Notes, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1655817Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1655816Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-JOINTJS-1579578Exploit, Third Party Advisory
https://github.com/clientIO/joint/commit/e5bf89efef6d5ea572d66870ffd86560de7830a8Patch, Third Party Advisory
https://github.com/clientIO/joint/pull/1514Third Party Advisory
https://github.com/clientIO/joint/releases/tag/v3.4.2Release Notes, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1655817Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1655816Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-JOINTJS-1579578Exploit, Third Party Advisory

Timeline

Published: Sep 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-234456.1This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its cont CVE-2021-234467.5The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Ser CVE-2021-234476.1This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content CVE-2021-234489.8All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.CVE-2021-2344910.0This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host CVE-2021-23455.4Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Fra CVE-2021-234509.8All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.CVE-2021-234519.8The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which CVE-2021-234529.8This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.CVE-2021-23465.4Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Fra CVE-2021-234607.5The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.CVE-2021-234639.1The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.Jdbc