Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-4278

CVE-2021-4278: tree-kit vulnerable to Prototype Pollution

7.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-4278
GHSA ID
GHSA-mw4x-g2x8-qcvf
EPSS Score
0.12709%
CWE
CWE-1321
Published
12/25/2022
Updated
2/2/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
tree-kitnpm< 0.7.00.7.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit diff shows critical security checks were added to path.js and dotPath.js: 1) Explicit 'proto' validation 2) Function type checks 3) Prototype pollution error throwing. The vulnerability description specifically mentions .path()/.dotPath() fixes. The pre-patch code in these functions allowed uncontrolled property creation using special keys like 'proto', which is the root cause of prototype pollution. The high confidence comes from direct correlation between the vulnerability description, CWE-1321 classification, and the specific security checks added in the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility *l*ssi*i** *s pro*l*m*ti* **s ***n *oun* in *ronv*l tr**-kit up to *.*.x. T*is *****ts *n unknown p*rt. T** m*nipul*tion l***s to improp*rly *ontroll** mo*i*i**tion o* o*j**t prototyp* *ttri*ut*s ('prototyp* pollution'). Up*r**in* to

Reasoning

T** *ommit *i** s*ows *riti**l s**urity ****ks w*r* ***** to p*t*.js *n* *otP*t*.js: *) *xpli*it '__proto__' v*li**tion *) *un*tion typ* ****ks *) Prototyp* pollution *rror t*rowin*. T** vuln*r**ility **s*ription sp**i*i**lly m*ntions .p*t*()/.*otP*t