LinkedIn dustjs prototype pollution

published 2022-12-21 3 y ago modified 2026-06-17 4 mo ago also GHSA-c6rp-wrp9-qr4q , EUVD-2022-7597

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits: 0; none known

A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is ddb6523832465d38c9d80189e9de60519ac307c3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216464.

Patch / fix

fixed in 2 links 3

npm dustjs-linkedin 3.0.0
linkedin dustjs 3.0.0

github.com/linkedin/dustjs@ddb6523 commit
github.com/linkedin/dustjs#805 pull request
github.com/linkedin/dustjs/releases/tag/v3.0.0 release

Exploit prediction

1.15% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/linkedin/dustjs/pull/805 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/linkedin/dustjs/issues/804 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	3.0	6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	dustjs-linkedin	<3.0.0	3.0.0

Affected products

LinkedIn dustjs

Classification

Weakness

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-94 Improper Control of Generation of Code

References

github.com /linkedin/dustjs/pull/805
issue-tracking, web, exploit, patch, third-party-advisory
github.com /linkedin/dustjs/commit/ddb6523832465d38c9d80189e9de60519ac307c3
patch, web, third-party-advisory
github.com /linkedin/dustjs/releases/tag/v3.0.0
patch, web, release-notes, third-party-advisory
github.com /linkedin/dustjs/issues/804
exploit, issue-tracking, web, third-party-advisory
vuldb.com /?id.216464
vdb-entry, web, third-party-advisory
vuldb.com /?ctiid.216464
signature, permissions-required, web, vdb-entry
nvd.nist.gov /vuln/detail/CVE-2021-4264
advisory
github.com /linkedin/dustjs
package

Sources

CVE List CVE-2021-4264
GitHub Advisory GHSA-c6rp-wrp9-qr4q
NVD CVE-2021-4264

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary