Prototype Pollution in Argencoders-Notevil Project
CVE-2021-23771
This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878).
Vulnerability class: Prototype Pollution
EPSS: 0.010 (59.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Argencoders-notevil_project Argencoders-notevil
- Notevil_project Notevil
- N/a Argencoders-notevil — versions 0
- N/a Notevil — versions 0
Weakness classification (CWE)
References
- report@snyk.io (Exploit, Third Party Advisory, x_refsource_MISC)
- report@snyk.io (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-23771?
- CVE-2021-23771 is a medium-severity vulnerability in Argencoders-Notevil Project, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 6.5/10. Published 2022-03-17.
- How severe is CVE-2021-23771?
- Medium severity. CVSS v3 base score is 6.5 out of 10.