CVE-2021-23460
Prototype Pollution
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Prototype Pollution
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
- Record
CVE-2021-23460- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P - Updated
- 2026-11-02
EUVDEUVD-2022-0586
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
- Record
EUVD-2022-0586- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2m53-83f3-562j
Prototype pollution in min-dash
Impact
The set method is vulnerable to prototype pollution with specially crafted inputs.
// insert the following into poc.js and run node poc,js (after installing the package)
let parser = require("min-dash");
parser.set({}, [["__proto__"], "polluted"], "success");
console.log(polluted);
Patches
min-dash>=3.8.1 fix the issue.
Workarounds
No workarounds exist for the issue.
References
Closed via https://github.com/bpmn-io/min-dash/pull/21.
Credits
Credits to Cristian-Alexandru STAICU who found the vulnerability and to Idan Digmi from the Snyk Security Team who reported the vulnerability to us, responsibly.
- Record
GHSA-2m53-83f3-562j- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fm93-fhh2-cg2c
Duplicate Advisory: Prototype Pollution in min-dash
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-2m53-83f3-562j. This link is maintained to preserve external references.
Original Description
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
- Record
GHSA-fm93-fhh2-cg2c- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
NVD
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
- Record
CVE-2021-23460- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
- Record
CVE-2021-23460- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-2m53-83f3-562j
Prototype pollution in min-dash
Impact
The set method is vulnerable to prototype pollution with specially crafted inputs.
// insert the following into poc.js and run node poc,js (after installing the package)
let parser = require("min-dash");
parser.set({}, [["__proto__"], "polluted"], "success");
console.log(polluted);
Patches
min-dash>=3.8.1 fix the issue.
Workarounds
No workarounds exist for the issue.
References
Closed via https://github.com/bpmn-io/min-dash/pull/21.
Credits
Credits to Cristian-Alexandru STAICU who found the vulnerability and to Idan Digmi from the Snyk Security Team who reported the vulnerability to us, responsibly.
- Record
GHSA-2m53-83f3-562j- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVGHSA-fm93-fhh2-cg2c
Duplicate Advisory: Prototype Pollution in min-dash
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-2m53-83f3-562j. This link is maintained to preserve external references.
Original Description
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
- Record
GHSA-fm93-fhh2-cg2c- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
min-dashnpm |
before 3.8.1 | 3.8.1 |
org.webjars.npm:min-dashMaven |
before 3.8.1 | 3.8.1 |
org.webjars.npm:min-dashMaven |
before 3.8.1, plus listed versions 3.2.03.4.03.5.2 |
3.8.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, published, references | EUVD | |
| first indexed | GitHub Advisories, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-23460 is a high vulnerability (CVSS 7.5) in Camunda Min-dash, published January 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.19%, the 82nd percentile. Fixed in min-dash 3.8.1.
References
snyk.io/vuln/SNYK-JS-MINDASH-2340605
github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js%23L32
Show 6 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-23460