CVE-2022-21824
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 21.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
- CVSS 3.1
- 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- EPSS
- 21.51% probability · 98th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-471, CWE-1321
- Affected
- nodejs/node.js · oracle/mysql cluster · oracle/mysql connectors · oracle/mysql enterprise monitor · oracle/mysql server · oracle/mysql workbench · oracle/peoplesoft enterprise peopletools · debian/debian linux · netapp/oncommand insight · netapp/oncommand workflow automation · netapp/snapcenter
- Source
- support@hackerone.com
EPSS 21.5% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://hackerone.com/reports/1431042Issue Tracking, Mitigation, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlMailing List, Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/Release Notes, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20220325-0007/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220729-0004/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5170Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
- https://hackerone.com/reports/1431042Issue Tracking, Mitigation, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlMailing List, Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/Release Notes, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20220325-0007/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220729-0004/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5170Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.