Fix prototype pollution in the zrender merge and clone helper methods

Vulnerability

ZRender, a lightweight 2D graphics library used by Apache ECharts, contains a prototype pollution vulnerability in the merge and clone helper methods defined in src/core/util.ts [1]. Versions prior to 5.2.1 (and prior to 4.3.3 on the 4.x branch) are affected [4]. The vulnerability is reachable when user-controllable objects with a __proto__ key are passed to these functions [1].

Exploitation

The attacker needs to supply a crafted object that includes a __proto__ property. When a victim application calls either merge or clone on that object, the nested __proto__ key is not sanitized, allowing the attacker to inject properties into the global Object.prototype [1][4]. No special network position, authentication, or user interaction beyond passing the malicious object is required, making this straightforward to exploit if the application merges or clones attacker-controlled data.

Impact

Successful prototype pollution can alter the behavior of all objects in the JavaScript runtime, potentially leading to property injection, denial of service, or arbitrary code execution depending on how downstream code uses the polluted properties [1][4]. Since ECharts exports echarts.util.merge and setOption uses these methods, any ECharts application that processes untrusted input risks compromise of the rendering environment and the wider web application [1].

Mitigation

ZRender version 5.2.1 (and 4.3.3 for the 4.x line) fix the issue by sanitizing __proto__ keys in the vulnerable methods [4]. Users should update ZRender to 5.2.1 or later, and if using Apache ECharts, update ECharts to 5.2.1 as well [1]. As a workaround, applications can manually inspect and omit any __proto__ key from objects before passing them to merge, clone, echarts.util.merge, or setOption [1]. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.