CVE-2021-39227 Fix prototype pollution in the zrender merge and clone helper methods

2021-09-1714:10:10

CWE-1321

GitHub_M

www.cve.org

cve-2021-39227

zrender

prototype pollution

apache echarts

security

vulnerability

patch

workaround

proof of concept

github advisory

version 5.2.1

echarts.util.merge

setoption

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

64.7%

JSON

ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using merge and clone helper methods in the src/core/util.ts module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is __proto__ in the object keys. Omit it before using it as an parameter in these affected methods. Or in echarts.util.merge and setOption if project is using ECharts.

CNA Affected

[
  {
    "product": "zrender",
    "vendor": "ecomfe",
    "versions": [
      {
        "status": "affected",
        "version": "< 5.2.1"
      }
    ]
  }
]