CVE-2021-23450: debian debian_linux Prototype Pollution
CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2021-23450DEBIAN-CVE-2021-23450GHSA-m8gw-hjpr-rjv7
Published 17-12-2021Last modified 08-10-2026
Vulnerability summary
CVE-2021-23450 is a critical (CVSS 9.8) Prototype Pollution vulnerability in debian debian_linux. EPSS estimates a 30.37% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 5 public exploits are recorded.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
30.37%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits5reference
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 17-12-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
CVSS metrics
6 scores · 5 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources5 sources · 7.5–9.8
- CVE.orgCNA7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:PDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
30.37%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 30.37% on 18-09-2026
18-09-202618-10-2026
EPSS score30.37%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
5 foundExploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Oracle3 products
- communications_policy_management12.6.0.0.0
- primavera_unifier≥ 17.7, ≤ 17.12 | 18.8 | 19.12 | 20.12 | 21.12
- weblogic_server12.2.1.4.0 | 14.1.1.0.0
Debian2 products
- dojo< 1.17.2+dfsg1-1
- debian_linuxEOL10.0
Linuxfoundation1 product
- dojo< 1.17.0
Npm1 product
- dojo≤ 1.16.4
Ubuntu1 product
- dojo< 1.10.4+dfsg-2ubuntu0.1~esm1 | All versions (No fix recorded) | < 1.15.0+dfsg1-1ubuntu0.1~esm1 | < 1.15.4+dfsg1-1ubuntu0.1
5 vendors · 8 products
References
15 links- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034REPORTWEBExploitMitigationThird Party Advisory
- github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172REPORTWEBBroken LinkThird Party Advisory
Show all 15 references
- github.com/dojo/dojoPACKAGE