CVE-2021-23413
1 advisory.
npm/jszip CVE-2021-23413: medium 5.3, EPSS 3.44%
jszip Vulnerable to Prototype Pollution
Action: Upgrade jszip to 2.7.0 or later.
npm i jszip@3.7.0npm i jszip@2.7.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.7.0 | - |
| 0 | 2.7.0 | - |
Fixed versions
| 3.7.0 | 2.7.0 |
Sources
- osv: GHSA-jg8v-48h5-wgxg
- https://nvd.nist.gov/vuln/detail/CVE-2021-23413
- https://github.com/Stuk/jszip/pull/766
- https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b36
- https://github.com/Stuk/jszip
- https://github.com/Stuk/jszip/blob/master/lib/object.js%23L88
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1251499
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1251498
- https://snyk.io/vuln/SNYK-JS-JSZIP-1251497
CVE-2021-23413 · published · modified · JSON