LiveActive security incident?Get immediate response
CVE Record

CVE-2021-23574: Prototype Pollution

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-23574 affects the js-data package. Maliciously shaped input can pollute JavaScript object prototypes through deepFillIn and set, potentially causing application instability. The supplied scoring emphasizes availability impact rather than data theft. It is a high-priority dependency issue where exposure depends on whether vulnerable js-data code is present and reachable by untrusted input.

Executive priority

Treat as high priority where js-data is used in internet-facing or automated data-processing paths. Confirm exposure quickly, because the public record does not name a complete safe version in the supplied bundle. Prioritize removal, replacement, or input validation if reachable.

Technical view

The vulnerability is prototype pollution in js-data via deepFillIn and set. The record describes it as an incomplete fix for CVE-2020-28442. CVSS 3.1 is 7.5: network-reachable, low complexity, no privileges, no user interaction, unchanged scope, with high availability impact and no stated confidentiality or integrity impact.

Likely exposure

Projects are exposed if they depend on js-data, including the referenced WebJars Bower or NPM packages, and pass attacker-controlled object data, keys, or paths into affected functions. The bundle does not provide affected version boundaries beyond stating all versions of js-data are vulnerable.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of active exploitation. CVSS indicates exploitation is plausible without authentication or user interaction, but the practical path depends on application-specific data flow into js-data.

Researcher notes

Evidence is limited to the CVE description, CVSS vector, Snyk references, and GitHub issue/code links. The bundle supports prototype pollution impact and incomplete prior fix, but not active exploitation, exact fixed versions, or a universal remediation path.

Mitigation direction

  • Inventory direct and transitive use of js-data and referenced WebJars packages.
  • Check Snyk and project GitHub guidance for fixed or recommended replacement versions.
  • Remove or replace js-data where no maintained safe version is available.
  • Restrict untrusted object keys before they reach deepFillIn or set code paths.
  • Add application-level validation rejecting prototype-related keys and unsafe path segments.

Validation and detection

  • Review package manifests, lockfiles, and SBOMs for js-data and referenced WebJars packages.
  • Run dependency scanning against CVE-2021-23574 or SNYK-JS-JSDATA-1584361.
  • Map routes and APIs that accept structured object input into js-data.
  • Review use of deepFillIn and set for attacker-controlled keys or paths.
  • Confirm compensating validation is tested on affected input paths.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-23574 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2021-23574Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/ajs-data0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.