CVE-2021-39227
Description
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using merge and clone helper methods in the src/core/util.ts module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is __proto__ in the object keys. Omit it before using it as an parameter in these affected methods. Or in echarts.util.merge and setOption if project is using ECharts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
zrendernpm | >= 5.0.0, < 5.2.1 | 5.2.1 |
zrendernpm | < 4.3.3 | 4.3.3 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/ecomfe/zrender/pull/826nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-fhv8-fx5f-7fxfghsaADVISORY
- github.com/ecomfe/zrender/releases/tag/5.2.1nvdRelease NotesThird Party AdvisoryWEB
- github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxfnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-39227ghsaADVISORY
News mentions
0No linked articles in our index yet.