Prototype Pollution in open-graph

CRITICO 9.8CVE-2021-23419 · GHSA-g452-6rfc-vrvx · SNYK-JS-OPENGRAPH-1536747 · Published 08/08/2021 · updated 17/06/2026

In breve

CVE-2021-23419 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda open-graph (open-graph project), open-graph.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 66.2% delle vulnerabilità.
Correzione: aggiornare a 0.2.6 o successiva.

Package	Affected versions	Patched versions
open-graph open-graph_project	`< 0.2.6`	`0.2.6`
open-graph npm	`< 0.2.6`	`0.2.6`

Description

This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload.

NVD description

This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.

References

nvd.nist.gov/vuln/detail/CVE-2021-23419 · ADVISORY
samholmes/node-open-graph commit a0cef50 · WEB
samholmes/node-open-graph · PACKAGE
snyk.io/vuln/SNYK-JS-OPENGRAPH-1536747 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free