{"id":"GHSA-m8gw-hjpr-rjv7","revision":"6101ab3d798d440cb5535160ac90ffb1","records":[{"revision":"6101ab3d798d440cb5535160ac90ffb1","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-m8gw-hjpr-rjv7","aliases":["CVE-2021-23450"],"title":"Prototype Pollution in dojo","description":"All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.","state":0,"publishedAt":"2022-01-05T15:01:46+00:00","modifiedAt":"2025-01-14T09:12:14.277759+00:00","affected":[{"ecosystem":"npm","name":"dojo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.16.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-23450","https://github.com/dojo/dojo","https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172","https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033","https://snyk.io/vuln/SNYK-JS-DOJO-1535223","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"sourceUrl":"https://github.com/advisories/GHSA-m8gw-hjpr-rjv7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-m8gw-hjpr-rjv7","identifiers":["GHSA-m8gw-hjpr-rjv7","CVE-2021-23450"]},"retained":false,"historicalAffected":[]}],"coverage":[]}