LiveActive security incident?Get immediate response
CVE Record

CVE-2021-39227: Fix prototype pollution in the zrender merge and clone helper methods

ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.

MediumCVSS 6.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-39227 is a prototype pollution flaw in ZRender before 5.2.1. If vulnerable helper methods process unsafe object keys, application behavior can be corrupted and availability can be affected. Apache ECharts exposure matters because it uses and exports these helper methods directly.

Executive priority

Treat this as a medium-priority dependency remediation, especially for externally facing dashboards or portals processing user-controlled chart data. Patch during the next normal security update cycle unless validation shows untrusted input reaches affected APIs.

Technical view

ZRender `merge` and `clone` helper methods in `src/core/util.ts` allowed prototype pollution before version 5.2.1. The CVSS vector is 6.2 medium, with high availability impact and no privileges or user interaction required. The associated weakness is CWE-1321.

Likely exposure

Exposure is most likely in web applications or services bundling `zrender` below 5.2.1, including projects using Apache ECharts APIs that call `echarts.util.merge` or `setOption` with attacker-influenced objects.

Exploitation context

The advisory states a proof of concept exists on GitHub. The provided sources do not show CISA KEV listing or active exploitation in the wild, so exploitation should be treated as plausible but not confirmed active.

Researcher notes

Evidence is strongest for affected versions, patch version, workaround, CVSS, and ECharts linkage. The bundle confirms public PoC availability but does not provide active exploitation evidence. Avoid assuming broader product impact beyond ZRender and ECharts usage described in the advisory.

Mitigation direction

  • Upgrade ZRender to version 5.2.1 or later.
  • Update Apache ECharts dependency paths that bundle vulnerable ZRender versions.
  • Reject or omit `__proto__` keys before using affected merge or clone helpers.
  • Avoid passing untrusted objects into `echarts.util.merge` or `setOption`.
  • Check current vendor guidance before deploying compensating controls.

Validation and detection

  • Review lockfiles and SBOMs for `zrender` versions below 5.2.1.
  • Identify Apache ECharts usage that imports or exposes ZRender helper methods.
  • Trace whether user-controlled objects reach `merge`, `clone`, `setOption`, or `echarts.util.merge`.
  • Confirm upgraded builds resolve to patched ZRender 5.2.1 or later.
  • Run existing application tests around chart option handling after remediation.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-1321: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-39227 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.2CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.2Medium
CVSS 3.1 vector shape for CVE-2021-39227Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
ecomfezrender< 5.2.1Listed
Weakness

CWE details

CWE-1321

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.