Prototype Pollution in think-helper

CAO 7.5CVE-2021-32736 · GHSA-vr5m-3h59-7jcp · Công bố 30/06/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-32736 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng think-helper (thinkjs), think-helper.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.0%, cao hơn 63.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.1.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
think-helper thinkjs	`< 1.1.3`	`1.1.3`
think-helper npm	`< 1.1.3`	`1.1.3`

Mô tả

Impact

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Patches

[email protected] patched it, anyone used think-helper should upgrade to >=1.1.3 version.

References

https://cwe.mitre.org/data/definitions/1321.html

For more information

If you have any questions or comments about this advisory:

Open an issue in thinkjs/thinkjs
Email us at [email protected]

Mô tả của NVD

think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3.