CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-23419
Critical (9.8) in open-graph project open-graph. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in open-graph 0.2.6.
This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- open-graph_project:open-graph
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g452-6rfc-vrvx | npm | open-graph | <0.2.6 | 0.2.6 |