← All advisories

Critical severityGHSA Advisory· Published Aug 11, 2021· Updated Sep 17, 2024

Prototype Pollution

CVE-2021-23421

Description

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
merge-changenpm	<= 1.8.1	—

Affected products

2

Vladimirshestakov/Merge ChangeGHSA
Range: <= 1.8.1
ghsa-coords
pkg:npm/merge-change
Range: <= 1.8.1

Patches

Vulnerability mechanics

References

5

github.com/advisories/GHSA-f9cv-665r-275hghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-23421ghsaADVISORY
github.com/VladimirShestakov/merge-change/blob/9901f145e06158f284f52de42e6ba5b0f702fb65/utils.jsghsaWEB
github.com/VladimirShestakov/merge-change/blob/9901f145e06158f284f52de42e6ba5b0f702fb65/utils.js%23L89-L123mitrex_refsource_MISC
snyk.io/vuln/SNYK-JS-MERGECHANGE-1310985ghsax_refsource_MISCWEB

News mentions

0

No linked articles in our index yet.