CVE-2021-39227: Prototype Pollution in the merge and clone helper methods

September 20, 2021 (updated December 6, 2024)

Using merge and clone helper methods in the src/core/util.ts module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly.

References

github.com/advisories/GHSA-fhv8-fx5f-7fxf
github.com/ecomfe/zrender
github.com/ecomfe/zrender/pull/826
github.com/ecomfe/zrender/releases/tag/5.2.1
github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf
nvd.nist.gov/vuln/detail/CVE-2021-39227

Code Behaviors & Features

Detect and mitigate CVE-2021-39227 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →