Skip to content
CVE Tracker
Back

CVE-2022-21189

Prototype Pollution

High7.3EPSS 1.7%
Published
Updated
Reserved
Assigned by
snyk

Description

The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This can allow an attacker to add/modify properties of the Object.prototype leading to prototype pollution vulnerability. **Note:** This vulnerability can occur in multiple ways, for example when modifying a collection with untrusted user input.

Scores

CVSS scores of CVE-2022-21189, by who scored it
Scored byCVSSScoreVector
snykCNA (assigner)3.1High7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
NVDNVD · Modified3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
1.7% · top 23% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Weakness

Affected products

  • dexie

    • affected unspecified – < 3.2.2
    • affected 4.0.0-alpha.1 – < unspecified
    • affected unspecified – < 4.0.0-alpha.3

Affected packages

From reviewed advisories of the GitHub Advisory Database.

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .