VulnerabilityModified
CVE-2021-32736
The vulnerability is patched in version 1.1.3.
HIGH 7.5EPSS 1.01%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.01%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.01% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1321
- Affected
- thinkjs/think-helper
- Source
- security-advisories@github.com
References
- https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcpThird Party Advisory
- https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcpThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.