VYPR
← All advisories
Critical severityNVD Advisory· Published Sep 6, 2021· Updated Aug 3, 2024

Prototype Pollution in vincit/objection.js

CVE-2021-3766

Description

objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
objectionnpm
< 2.2.162.2.16

Affected products

1

Patches

1
46b842a6bc89

Security Fix for Prototype Pollution

https://github.com/Vincit/objection.jsready-researchSep 3, 2021via ghsa
commit
1 file changed · +7 −1
  • lib/utils/objectUtils.js+7 −1 modified
    @@ -225,6 +225,9 @@ function set(obj, path, value) {
 
   for (let i = 0, l = path.length - 1; i < l; ++i) {
     const key = path[i];
+    if (key === '__proto__') {
+      return false;
+    }
     let child = obj[key];
 
     if (!isObject(child)) {
@@ -252,7 +255,10 @@ function set(obj, path, value) {
 function zipObject(keys, values) {
   const out = {};
 
-  for (let i = 0, l = keys.length; i < l; ++i) {
+  for (let i = 0, l = keys.length; i < l; ++i) {    
+    if (keys[i] === '__proto__') {
+      return false;
+    }
     out[keys[i]] = values[i];
   }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.