LiveActive security incident?Get immediate response
CVE Record

CVE-2021-23507: Prototype Pollution

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-23507 affects the JavaScript package object-path-set before 1.0.2. A flaw in path setting can let attacker-controlled input tamper with JavaScript object prototypes, potentially causing application crashes or denial of service. The bundle does not show active exploitation, but the issue is rated high.

Executive priority

Prioritize remediation where this package is used in internet-facing services or request-processing paths. The business risk is mainly service disruption, not confirmed data theft, based on the supplied CVSS impacts.

Technical view

The vulnerable setPath method in object-path-set permits prototype pollution by allowing unsafe prototype-related paths to be merged into objects. The CVSS data emphasizes availability impact, with network attack vector, low complexity, no privileges, and no user interaction. The issue is described as an incomplete fix for an earlier Snyk advisory.

Likely exposure

Exposure is most likely in Node.js or browser build pipelines that depend directly or transitively on object-path-set before 1.0.2 and pass untrusted path data into setPath-like behavior.

Exploitation context

The source bundle marks KEV as false and does not cite active exploitation. The provided CVSS vector includes proof-of-concept maturity, so treat exploitability as plausible while avoiding assumptions about real-world abuse.

Researcher notes

Focus validation on dependency resolution and attacker influence over path arguments. Sources identify prototype pollution in setPath and a fixing commit, but the bundle does not provide affected application scenarios, exploitation telemetry, or a broader vendor mitigation matrix.

Mitigation direction

  • Upgrade object-path-set to version 1.0.2 or later.
  • Refresh lockfiles so transitive copies resolve to a fixed version.
  • Review vendor and Snyk guidance for any package-specific remediation notes.
  • Restrict untrusted input from controlling object paths where practical.

Validation and detection

  • Inspect package manifests and lockfiles for object-path-set below 1.0.2.
  • Check dependency trees for transitive vulnerable copies.
  • Review code paths that pass user-controlled values into setPath.
  • Confirm SCA results no longer flag SNYK-JS-OBJECTPATHSET-2388576.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-23507 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2021-23507Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aobject-path-setunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.