Vulnerability Description
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Merge Project | Merge | < 1.0.2 |
Related Weaknesses (CWE)
References
- https://github.com/viking04/merge/commit/baba40332080b38b33840d2614df6d4142dedafPatchThird Party Advisory
- https://huntr.dev/bounties/ef387a9e-ca3c-4c21-80e3-d34a6a896262ExploitThird Party Advisory
- https://github.com/viking04/merge/commit/baba40332080b38b33840d2614df6d4142dedafPatchThird Party Advisory
- https://huntr.dev/bounties/ef387a9e-ca3c-4c21-80e3-d34a6a896262ExploitThird Party Advisory
FAQ
What is CVE-2021-3645?
CVE-2021-3645 is a vulnerability with a CVSS score of 9.8 (CRITICAL). merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
How severe is CVE-2021-3645?
CVE-2021-3645 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-3645?
Check the references section above for vendor advisories and patch information. Affected products include: Merge Project Merge.