CVE-2021-23771

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1321

Affected software

VendorProductVersions
n/anotevil< unspecified
n/aargencoders-notevil< unspecified

References

Timeline

Published
Mar 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-237728.8This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of fiCVE-2021-23787.5Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2021-237846.1This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without beinCVE-2021-237929.8The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecureCVE-2021-237979.8All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is.CVE-2021-23807.6Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Supported versCVE-2021-238039.8This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the applicationCVE-2021-238079.8This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fixCVE-2021-23813.9Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily explCVE-2021-238148.8This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the filCVE-2021-23829.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security). Supported versions that are affected CVE-2021-238209.8This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer com