CVE-2021-4278 json
cronvel tree-kit prototype pollution
published 2022-12-25 3 y ago modified 2026-06-17 4 mo ago also GHSA-mw4x-g2x8-qcvf , EUVD-2022-7692
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to address this issue. The name of the patch is a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. It is recommended to upgrade the affected component. The identifier VDB-216765 was assigned to this vulnerability.
Patch / fix
- npm tree-kit 0.7.0
- tree_kit_project tree_kit 0.7.0
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | tree-kit | <0.7.0 |
0.7.0 |
Affected products
- cronvel tree-kit
Classification
- Weakness
-
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
References
-
github.com
/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd
patch, web, third-party-advisory
-
github.com
/cronvel/tree-kit/releases/tag/v0.7.0
patch, web, release-notes, third-party-advisory
-
vuldb.com
/?id.216765
vdb-entry, web, third-party-advisory
-
vuldb.com
/?ctiid.216765
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-4278
advisory
-
github.com
/cronvel/tree-kit
package
Sources
- CVE List CVE-2021-4278
- GitHub Advisory GHSA-mw4x-g2x8-qcvf
- NVD CVE-2021-4278
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.