CVE-2021-42581

Published: May 10, 2022Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes

Affected (1)

Products: Ramdajs: Ramda

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ramdajs Ramda	Up to 0.27.0

Related CWEs

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (4)

https://github.com/ramda/ramda/pull/3192

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://jsfiddle.net/3pomzw5g/2/

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/ramda/ramda/pull/3192

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://jsfiddle.net/3pomzw5g/2/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.