PT-2021-23086 · Aurelia · Aurelia-Path+1

Msrkp · Published 2021-09-27 · Updated 2026-01-29 · CVE-2021-41097

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions aurelia-path versions prior to 1.1.7

Description The issue is related to a prototype pollution vulnerability in aurelia-path, which is part of the Aurelia platform and contains utilities for path manipulation. This vulnerability exposes Aurelia applications that use the aurelia-path package to parse a string, particularly those that employ the aurelia-router package. An example of exploitation could involve an attacker tricking an application into parsing a URL like https://aurelia.io/blog/? proto [asdf]=asdf, potentially allowing the attacker to change the prototype of the base object class Object.

Recommendations For versions prior to 1.1.7, update to version 1.1.7 to resolve the issue. As a temporary workaround, consider using Object.freeze(Object.prototype) to partially mitigate the vulnerability.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-41097

GHSA-3C9C-2P65-QVWV

Affected Products

Aurelia-Path

Aurelia-Router

References · 11

• 🔥 https://github.com/aurelia/path/issues/44 · Exploit
• https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41097 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41097 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3c9c-2p65-qvwv · Vendor Advisory
• https://github.com/aurelia/path · Note
• https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv · Note
• https://github.com/aurelia/path/releases/tag/1.1.7 · Note
• https://twitter.com/pdnuclei_bot/status/2016753206014201954 · Twitter Post
• https://npmjs.com/package/aurelia-path · Note
• https://t.me/cibsecurity/29519 · Telegram Post