Vulnerability · Published Jun 30, 2021 · Assigned by GitHub_M

CVE-2021-32736Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helper

High 7.5

In plain English

A high-severity prototype pollution in think-helper from thinkjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.0%top 36.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	think-helper	1.1.3	GHSA-vr5m-3h59-7jcp

Affected products (as reported)

Vendor	Product	Versions
thinkjs	think-helper	< 1.1.3

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp x_refsource_CONFIRM