MEDIUM6.2

GHSA-fhv8-fx5f-7fxf

Prototype Pollution in the merge and clone helper methods

Quick fix

GHSA-fhv8-fx5f-7fxf — zrender: upgrade to the fixed version with the command below.

npm install zrender@5.2.1

Details

### Impact Using `merge` and `clone` helper methods in the `src/core/util.ts` module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly.

### Patches It has been patched in https://github.com/ecomfe/zrender/pull/826. Users should update zrender to `5.2.1`. and update echarts to `5.2.1` if project is using echarts.

### References NA

### For more information NA

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/zrender

Introduced in: 5.0.0Fixed in: 5.2.1

Fixnpm install zrender@5.2.1

npm/zrender

Introduced in: 0Fixed in: 4.3.3

Fixnpm install zrender@4.3.3

References

https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2021-39227[ADVISORY]
https://github.com/ecomfe/zrender/pull/826[WEB]
https://github.com/ecomfe/zrender[PACKAGE]
https://github.com/ecomfe/zrender/releases/tag/5.2.1[WEB]