How severe is CVE-2021-39227?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2021-39227?

This is classified as CWE-1321, which is a common weakness in software security.

CVE-2021-39227 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.

Related Vulnerabilities

CVE-2019-0230

CRITICAL

CVSS:9.8(Critical)

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

CWE-13212019

CVE-2019-14379

CRITICAL

CVSS:9.8(Critical)

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leadi...

CWE-13212019

CVE-2019-19919

CRITICAL

CVSS:9.8(Critical)

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow...

CWE-13212019

CVE-2020-28269

CRITICAL

CVSS:9.8(Critical)

Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.

CWE-13212020

CVE-2020-28270

CRITICAL

CVSS:9.8(Critical)

Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.

CWE-13212020

CVE-2020-28271

CRITICAL

CVSS:9.8(Critical)

Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.

CWE-13212020