PT-2022-7301 · Async+2 · Async+2
Mriedem
·
Published
2022-04-06
·
Updated
2025-06-25
·
CVE-2021-43138
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Async versions 2.x through 2.6.3
Async versions 3.x through 3.2.1
Description
The issue is related to the
mapValues() function in the Async library, which is used for working with asynchronous JavaScript. It involves the incorrect control of modifications to an object's prototype attributes. This could allow a remote attacker to elevate their privileges. A malicious user can exploit this issue via the mapValues() method, also known as lib/internal/iterator.js createObjectIterator prototype pollution.Recommendations
For Async versions 2.x through 2.6.3, update to version 2.6.4 to resolve the issue.
For Async versions 3.x through 3.2.1, update to version 3.2.2 to resolve the issue.
As a temporary workaround, consider disabling the
mapValues() function until a patch is available.Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Async
Red Os
Suse