CVE-2021-3645
9.8 CRITICALmerge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published: 2021-09-10 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-1321
Affected products
| Vendor | Product |
|---|---|
| merge_project | merge |
Description
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3645
- [Patch]https://github.com/viking04/merge/commit/baba40332080b38b33840d2614df6d4142dedaf6
- [Exploit reference]https://huntr.dev/bounties/ef387a9e-ca3c-4c21-80e3-d34a6a896262
- [Patch]https://github.com/viking04/merge/commit/baba40332080b38b33840d2614df6d4142dedaf6
- [Exploit reference]https://huntr.dev/bounties/ef387a9e-ca3c-4c21-80e3-d34a6a896262
Related CVEs
Same CWE
- CVE-2026-48714 — i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno (9.1 CRITICAL)
- CVE-2026-48713 — Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation ke... (9.1 CRITICAL)
- CVE-2026-12209 — A security vulnerability has been detected in RubyLouvre avalon up to 2.2.10 (5.3 MEDIUM)
- CVE-2026-12208 — A weakness has been identified in jsonata-js jsonata up to 2.2.0 (5.3 MEDIUM)
- CVE-2026-53609 — ApostropheCMS is an open-source Node.js content management system (9.1 CRITICAL)