GHSA-fhv8-fx5f-7fxfMediumCVSS 6.2

Prototype Pollution in the merge and clone helper methods

Published
September 20, 2021
Last Modified
December 6, 2024

🔗 CVE IDs covered (1)

CVE-2021-39227 →

📋 Description

Impact

Using merge and clone helper methods in the src/core/util.ts module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly.

Patches

It has been patched in https://github.com/ecomfe/zrender/pull/826. Users should update zrender to 5.2.1. and update echarts to 5.2.1 if project is using echarts.

References

NA

For more information

NA

🎯 Affected products2

  • npm/zrender:>= 5.0.0, < 5.2.1
  • npm/zrender:<= 4.3.2

🔗 References (5)