CVE-2021-43138: async_project async
Vulnerability summary
CVE-2021-43138 is a high (CVSS 7.8) vulnerability in async_project async. EPSS estimates a 3.35% chance of exploitation in the next 30 days, higher than 88.6% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 12Timeline
- 06-04-2022PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · NpmEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- wordfenceSource7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.35%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.35% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (jsfiddle.net)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-1321Improperly Controlled Modification of Object Prototype AttributesThe product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Affected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Async_project1 product
- async< 2.6.4 | ≥ 3.0.0, < 3.2.2
Fedoraproject1 product
- fedoraEOL36 | 37
Npm1 product
- async≥ 3.0.0, < 3.2.2 | ≥ 2.0.0, < 2.6.4
Wordpress1 product
- insert-special-characters≤ 1.0.4 (fixed in 1.0.5)
4 vendors · 4 products
References
20 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 20 references
- github.com/caolan/asyncPACKAGE