ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.
References
Link | Resource |
---|---|
https://github.com/ecomfe/zrender/pull/826 | Patch Third Party Advisory |
https://github.com/ecomfe/zrender/releases/tag/5.2.1 | Release Notes Third Party Advisory |
https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2021-09-17T14:10:10
Updated: 2021-09-17T14:10:10
Reserved: 2021-08-16T00:00:00
Link: CVE-2021-39227
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-09-17T14:15:08.353
Modified: 2022-09-10T02:45:27.430
Link: CVE-2021-39227
JSON object: View
Redhat Information
No data.
CWE