Prototype Pollution in Baidu Zrender
CVE-2021-39227
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.
Vulnerability class: Prototype Pollution
EPSS: 0.014 (69.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Baidu Zrender
- Ecomfe Zrender — versions < 5.2.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2021-39227?
- CVE-2021-39227 is a medium-severity vulnerability in Baidu Zrender, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 6.2/10. Published 2021-09-17.
- How severe is CVE-2021-39227?
- Medium severity. CVSS v3 base score is 6.2 out of 10.
- Is CVE-2021-39227 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.