CVE-2021-26707 Prototype pollution in Merge-deep
The merge-deep library allows prototype pollution, enabling attackers to modify Object.prototype and potentially execute code or escalate privileges in Node.js applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26707?
CVE-2021-26707 is a critical vulnerability in Netapp E-Series Performance Analyzer, published on 2 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
Weakness: CWE-1321
Which versions are affected by CVE-2021-26707?
2 open source packages ship an affected version, including merge-deep. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
merge-deep npm | All versions | 3.0.3 |
merge-deep npm | All versions | 3.0.3 |
Products include Merge-Deep Project Merge-Deep, Netapp E-Series Performance Analyzer.
How do I fix CVE-2021-26707?
Upgrade merge-deep to 3.0.3 or later.
Is CVE-2021-26707 being exploited?
There is no known exploitation of CVE-2021-26707 in the wild and no public exploit code.
Other vulnerabilities in Netapp E-Series Performance Analyzer
Sources
Also known as GHSA-r6rj-9ch6-g264, ROOT-APP-NPM-CVE-2021-26707.