{"cve":"CVE-2021-39227","nvd":{"published":"2021-09-17T14:15:08.353","modified":"2026-06-17T04:03:21.320","status":"Modified","description":"ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-1321"],"references":["https://github.com/ecomfe/zrender/pull/826","https://github.com/ecomfe/zrender/releases/tag/5.2.1","https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf","https://github.com/ecomfe/zrender/pull/826","https://github.com/ecomfe/zrender/releases/tag/5.2.1"],"products":["baidu:zrender"],"source":"nvd","synced_at":"2026-10-19T21:23:41.316049955+00:00"},"epss":{"cve":"CVE-2021-39227","score":0.01266,"percentile":0.69749,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-fhv8-fx5f-7fxf","url":"https://osv.dev/vulnerability/GHSA-fhv8-fx5f-7fxf","summary":"Prototype Pollution in the merge and clone helper methods","modified":"2026-07-08T06:28:58.491405487Z","packages":[{"ecosystem":"npm","name":"zrender","purl":"pkg:npm/zrender","ranges":[">=5.0.0 <5.2.1"],"fixed":["5.2.1"]},{"ecosystem":"npm","name":"zrender","purl":"pkg:npm/zrender","ranges":["<4.3.3"],"fixed":["4.3.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}