CVE-2021-23450High· 7.5▾ TwilightAll versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 6.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
30%
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
dojo < 1.17.0communications_policy_management = 12.6.0.0.0primavera_unifier >= 17.7, <= 17.12primavera_unifier = 18.8primavera_unifier = 19.12primavera_unifier = 20.12primavera_unifier = 21.12weblogic_server = 12.2.1.4.0weblogic_server = 14.1.1.0.0debian_linux = 10.0Upgrade past the affected range:
dojo 1.17.0Connected by shared product, vendor, weakness, or advisory.
CVE-2020-5258High· 7.7In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution
CVE-2026-2950Medium· 6.5The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution
CVE-2026-106550High· 7.5Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set()
CVE-2026-104852High· 8.2GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas
CVE-2026-104848Critical· 9.5Tinypool is a minimal Node.js worker thread pool implementation
CVE-2026-104183Medium· 5.1stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint