CVE-2021-23771: Sandbox escape in notevil and argencoders-notevil

March 17, 2022 (updated March 24, 2022)

This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object’s prototype. Note: This vulnerability derives from an incomplete fix in SNYK-JS-NOTEVIL-608878.

References

github.com/advisories/GHSA-8g4m-cjm2-96wq
nvd.nist.gov/vuln/detail/CVE-2021-23771
snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587
snyk.io/vuln/SNYK-JS-NOTEVIL-2385946

Code Behaviors & Features

Detect and mitigate CVE-2021-23771 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →