CVE Vulnerabilities

CVE-2022-21169

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Published: Sep 26, 2022 | Modified: May 21, 2025
CVSS 3.x
6.1
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

Weakness

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected Software

Name Vendor Start Version End Version
Express_xss_sanitizer Express_xss_sanitizer_project * 1.1.3 (excluding)

Potential Mitigations

References