PT-2021-15507 · Unknown · Open-Graph

Published 2021-08-08 · Updated 2024-01-31 · CVE-2021-23419

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions open-graph versions prior to 0.2.6

Description The issue affects the parse function, which can be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload. This could potentially lead to unintended behavior or security issues.

Recommendations For versions prior to 0.2.6, update to version 0.2.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the parse function until a patch is available.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-23419

GHSA-G452-6RFC-VRVX

SNYK-JS-OPENGRAPH-1536747

Affected Products

Open-Graph

References · 8

• 🔥 https://snyk.io/vuln/SNYK-JS-OPENGRAPH-1536747 · Exploit
• https://github.com/samholmes/node-open-graph/commit/a0cef507a90adaac7dbbe9c404f09a50bdefb348 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23419 · Security Note
• https://osv.dev/vulnerability/GHSA-g452-6rfc-vrvx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23419 · Vendor Advisory
• https://github.com/samholmes/node-open-graph · Note
• https://twitter.com/AikidoSecurity/status/1752632355280343417 · Twitter Post
• https://t.me/cvenotify/19470 · Telegram Post