CVE-2021-23413 PUBLISHED

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

EPSS 0.14% · 33.9th percentile

Risk Scores

EPSS Score
0.14%
33.9th percentile

Affected Products

VendorProductVersions
Ubuntu:25.10node-jszip0, 3.10.1+dfsg-2
Ubuntu:18.04:LTSnode-jszip0, 3.1.4+dfsg-1
Ubuntu:22.04:LTSnode-jszip3.7.1+dfsg-1, 0, 3.5.0+dfsg-2
Ubuntu:20.04:LTSnode-jszip0, 3.2.2+dfsg-1
Ubuntu:24.04:LTSnode-jszip0, 3.10.1+dfsg-2

Timeline

References

Open in Interactive Console →