CVE-2021-32736 json
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helper
published 2021-06-30 5 y ago modified 2026-07-08 4 mo ago also GHSA-vr5m-3h59-7jcp , EUVD-2021-1494
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3.
Patch / fix
- npm think-helper 1.1.3
- thinkjs think-helper 1.1.3
Exploit prediction
1.01% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | think-helper | <1.1.3 |
1.1.3 |
Affected products
- thinkjs think-helper
Classification
References
-
github.com
/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-32736
advisory
-
github.com
/thinkjs/think-helper
package
Sources
- CVE List CVE-2021-32736
- GitHub Advisory GHSA-vr5m-3h59-7jcp
- NVD CVE-2021-32736
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.