9.8

CVE-2021-4279: Starcounter-Jack JSON-Patch prototype pollution

Modified
AliasesGHSA-8gh8-hqwg-xf34
Published 25-12-2022Last modified 03-08-2024

Vulnerability summary

CVE-2021-4279 is a critical (CVSS 9.8) vulnerability in starcounter-jack json-patch. EPSS estimates a 1.16% chance of exploitation in the next 30 days, higher than 67.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
1.16%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Timeline

  1. 25-12-2022
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

1.16%

Chance of exploitation in the next 30 days

Percentile

67%

Versus all other CVEs

30-day change

Increase +0.04 pp

From 1.11% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Json Patch

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Npm1 product
  • fast-json-patch< 3.1.1
Starcounter-jack1 product

2 vendors · 2 products

References

9 links