{"id":"CVE-2021-23470","aliases":["EUVD-2022-0813","GHSA-4g77-cvgw-grvw","SNYK-JS-PUTILMERGE-2391487"],"status":"published","title":"Prototype Pollution","description":"This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01266,"percentile":0.7015,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2022-02-04T20:05:12Z","modified":"2026-10-20T10:54:32Z","fixes":[{"ecosystem":"npm","package":"putil-merge","fixed_in":["3.8.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"putil-merge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0"}]}]},{"source":"osv","ecosystem":"npm","package":"putil-merge","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.0"}]}]}],"products":[{"vendor":"putil-merge_project","product":"putil-merge"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-PUTILMERGE-2391487","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence","web"]},{"url":"https://github.com/panates/putil-merge/commit/476d00078dfb2827d7c9ee0f2392c81b864f7bc5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23470","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4g77-cvgw-grvw"},{"url":"https://github.com/panates/putil-merge","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-23470","title":"Prototype Pollution","description":"This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077","status":"published","published":"2022-02-04T20:05:12.083Z","modified":"2024-09-16T23:32:07.792Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2022-0813","description":"This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077","status":"published","published":"2022-02-04T20:05:12Z","modified":"2024-09-16T23:32:07Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P","level":"high"}],"updated_at":"2026-11-03T00:54:49.244391Z"}],"ghsa":[{"id":"GHSA-4g77-cvgw-grvw","title":"Prototype Pollution in putil-merge","description":"This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077","status":"published","published":"2022-02-05T00:00:31Z","modified":"2023-02-03T05:05:31Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:36:42.703723Z"}],"nvd":[{"id":"CVE-2021-23470","description":"This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077","status":"published","published":"2022-02-04T20:15:08.363Z","modified":"2026-06-17T03:38:47.72Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:07:04.178977Z"}],"osv":[{"id":"CVE-2021-23470","description":"This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077","status":"published","published":"2022-02-04T20:15:08.363Z","modified":"2026-10-20T10:54:32.543962364Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"GHSA-4g77-cvgw-grvw","title":"Prototype Pollution in putil-merge","description":"This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077","status":"published","published":"2022-02-05T00:00:31Z","modified":"2026-07-08T06:49:37.509092097Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}