CVE-2021-4278

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to address this issue. The name of the patch is a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. It is recommended to upgrade the affected component. The identifier VDB-216765 was assigned to this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1321

Affected software

Vendor	Product	Versions
cronvel	tree-kit	0.1; 0.2; 0.3; 0.4; 0.5; 0.6

References

https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcdPatch, Third Party Advisory
https://github.com/cronvel/tree-kit/releases/tag/v0.7.0Release Notes, Third Party Advisory
https://vuldb.com/?ctiid.216765Third Party Advisory
https://vuldb.com/?id.216765Third Party Advisory
https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcdPatch, Third Party Advisory
https://github.com/cronvel/tree-kit/releases/tag/v0.7.0Release Notes, Third Party Advisory
https://vuldb.com/?ctiid.216765Third Party Advisory
https://vuldb.com/?id.216765Third Party Advisory

Timeline

Published: Dec 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-427805.3A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the li CVE-2021-427815.3Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the CVE-2021-427825.3Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the li CVE-2021-427839.8Missing Authentication for Critical Function vulnerability in debug_post_set.cgi of D-Link DWR-932C E1 firmware allows an unauthenticated at CVE-2021-427849.8OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a CVE-2021-427859.8Buffer Overflow vulnerability in tvnviewer.exe of TightVNC Viewer allows a remote attacker to execute arbitrary instructions via a crafted F CVE-2021-427869.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple inst CVE-2021-427879.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentConfigurationServlet has directory traversal vulner CVE-2021-42799.8A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown CVE-2021-427917.3An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does CVE-2021-427945.3An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a CVE-2021-427969.8An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticate