CVE-2021-32736

Published: Jun 30, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3.

Affected (1)

Products: Thinkjs: Think Helper

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Thinkjs Think Helper	Before 1.1.3

Related CWEs

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (2)

https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp

Source: security-advisories@github.com

Third Party Advisory

https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.