CVE-2021-3766
9.8 CRITICALobjection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published: 2021-09-06 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-1321
Affected products
| Vendor | Product |
|---|---|
| objection_project | objection |
Description
objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3766
- [Patch]https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9
- [Patch]https://huntr.dev/bounties/c98e0f0e-ebf2-4072-be73-a1848ea031cc
- [Patch]https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9
- [Patch]https://huntr.dev/bounties/c98e0f0e-ebf2-4072-be73-a1848ea031cc
Related CVEs
Same CWE
- CVE-2026-48714 — i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno (9.1 CRITICAL)
- CVE-2026-48713 — Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation ke... (9.1 CRITICAL)
- CVE-2026-12209 — A security vulnerability has been detected in RubyLouvre avalon up to 2.2.10 (5.3 MEDIUM)
- CVE-2026-12208 — A weakness has been identified in jsonata-js jsonata up to 2.2.0 (5.3 MEDIUM)
- CVE-2026-53609 — ApostropheCMS is an open-source Node.js content management system (9.1 CRITICAL)