CVE-2022-21824

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Feb 24, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-218257.8An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow aCVE-2022-218265.4Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request,CVE-2022-218277.1An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 wCVE-2022-218287.2A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unsCVE-2022-218299.8Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which cCVE-2022-21837.8Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.CVE-2022-218306.1A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in CVE-2022-218319.8A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguCVE-2022-218337.8Virtual Machine IDE Drive Elevation of Privilege VulnerabilityCVE-2022-218347.8Windows User-mode Driver Framework Reflector Driver Elevation of Privilege VulnerabilityCVE-2022-218357.8Microsoft Cryptographic Services Elevation of Privilege VulnerabilityCVE-2022-218367.8Windows Certificate Spoofing Vulnerability
CVE-2022-21824: High severity, CVSS 8.2 | Vulnix