CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-44908
Critical (9.8) in sailsjs sails. EPSS 1.8% chance of exploitation in the next 30 days.
SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().
Severity
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1321
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sailsjs:sails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8v3j-jfg3-v3fv | npm | sails | <=1.5.2 | no fix published |
References
- https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/sailsJS%20PoC.zip
- https://github.com/balderdashy/sails/blob/master/lib/app/private/controller/load-action-modules.js#L32
- https://github.com/balderdashy/sails/issues/7209
- https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/sailsJS%20PoC.zip
- https://github.com/balderdashy/sails/blob/master/lib/app/private/controller/load-action-modules.js#L32