Prototype Pollution in dojo

CRITICAL 9.8CVE-2021-23450 · GHSA-m8gw-hjpr-rjv7 · Published 17/12/2021 · updated 08/10/2026

In short

CVE-2021-23450 is a CRITICAL (CVSS 9.8) vulnerability affecting dojo (linuxfoundation), communications policy management (oracle), primavera unifier (oracle).
Chance of exploitation in the next 30 days (EPSS): 30.4%, higher than 98.2% of all vulnerabilities.
Fix: update to 1.17.0 or later.

Package	Affected versions	Patched versions
dojo linuxfoundation	`< 1.17.0`	`1.17.0`
communications policy management oracle	`= 12.6.0.0.0`	No fix yet
primavera unifier oracle	`= 18.8= 19.12= 20.12= 21.12≥ 17.7, ≤ 17.12`	No fix yet
weblogic server oracle	`= 12.2.1.4.0= 14.1.1.0.0`	No fix yet
dojo npm	`≤ 1.16.4`	No fix yet

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

NVD description

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.