Fluid Attacks Database

Description

Prototype Pollution in the merge and clone helper methods

Impact

Using merge and clone helper methods in the src/core/util.ts module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly.

Patches

It has been patched in https://github.com/ecomfe/zrender/pull/826. Users should update zrender to 5.2.1. and update echarts to 5.2.1 if project is using echarts.

References

For more information

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	zrender	>=5.0.0 <5.2.1 \|\| >=0 <4.3.3	5.2.1, 4.3.3

Aliases

1. CVE-2021-392272. NVD-2021-392273. OSV-2021-392274. GHSA-fhv8-fx5f-7fxf5. GCVE-2021-39227

References

1. https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf2. https://github.com/ecomfe/zrender/pull/8263. https://github.com/ecomfe/zrender/releases/tag/5.2.1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.