Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2021-23419: Open-Graph Prototype Pollution in open-graph <= 0.2.6
CVE-2021-23419 · published 5 years ago
Summary
An attacker could manipulate data by exploiting a flaw in the open-graph package, potentially leading to unpredictable behavior in applications that use it. This vulnerability affects developers who rely on the open-graph package for handling data. To secure their applications, they should update to the latest version of open-graph (0.2.7 or later).
What to do
- Update samholmes open-graph to version 0.2.6.
- Update open-graph_project open-graph to version 0.2.6 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | samholmes | open-graph |
< 0.2.6 Fix: upgrade to 0.2.6
|
| – | open-graph_project | open-graph |
< 0.2.6 cpe:2.3:a:open-graph_project:open-graph:*:*:*:*:*:node.js:*:* |
Original advisory text
Prototype Pollution in open-graph
This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-23419
- https://github.com/advisories/GHSA-g452-6rfc-vrvx
- https://github.com/samholmes/node-open-graph Product
- https://github.com/samholmes/node-open-graph/commit/a0cef507a90adaac7dbbe9c404f0... Patch Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-OPENGRAPH-1536747 Exploit Patch Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
9.8
Critical
Type
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-1321Prototype Pollution
Timeline
Published8 Aug 2021
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta