Vulnerability · Published Sep 17, 2021 · Assigned by GitHub_M

CVE-2021-39227Fix prototype pollution in the zrender merge and clone helper methods

Medium 6.2

In plain English

A medium-severity prototype pollution in zrender from ecomfe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)1.3%top 30.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	zrender	5.2.1	GHSA-fhv8-fx5f-7fxf
npm	zrender	4.3.3	GHSA-fhv8-fx5f-7fxf

Affected products (as reported)

Vendor	Product	Versions
ecomfe	zrender	< 5.2.1

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf x_refsource_CONFIRM
https://github.com/ecomfe/zrender/pull/826 x_refsource_MISC
https://github.com/ecomfe/zrender/releases/tag/5.2.1 x_refsource_MISC