What is CVE-2021-39227?

CVE-2021-39227 is a medium-severity vulnerability in Baidu Zrender, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 6.2/10. Published 2021-09-17.

How severe is CVE-2021-39227?

Medium severity. CVSS v3 base score is 6.2 out of 10.

Is CVE-2021-39227 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Prototype Pollution in Baidu Zrender

CVE-2021-39227

ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.

Vulnerability class: Prototype Pollution

Published 2021-09-17 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.014 (71.3th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 71st percentile — 71.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000

Affected products

Baidu Zrender
Ecomfe Zrender — versions < 5.2.1

Weakness classification (CWE)

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

Public proof-of-concept exploits

SMCallan/-Interactive-Data-Dashboards-with-React

References

github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf (Third Party Advisory)
github.com/ecomfe/zrender/pull/826 (Patch, Third Party Advisory)
github.com/ecomfe/zrender/releases/tag/5.2.1 (Third Party Advisory, Release Notes)

Frequently asked questions

What is CVE-2021-39227?: CVE-2021-39227 is a medium-severity vulnerability in Baidu Zrender, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 6.2/10. Published 2021-09-17.
How severe is CVE-2021-39227?: Medium severity. CVSS v3 base score is 6.2 out of 10.
Is CVE-2021-39227 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.