CVE-2021-23432

9.8 criticalEPSS 0.9%

Critical (9.8) in mootools project mootools. EPSS 0.9% chance of exploitation in the next 30 days.

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()

Severity

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
Published: 2021-08-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-x6hx-7gh3-3q98	npm	mootools	<=1.5.2	no fix published