Prototype pollution in litespeed.js
Priority MEDIUM 46CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
Why it matters now
EPSS 0.02117 81st percentileScored 2026-11-07
Fix Fixed litespeed.js: 0.3.12appwrite/server-ce: 0.12.2, 0.11.1+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | litespeed.js | before 0.3.12 | 0.3.12 | Patch available | CNA |
| — | appwrite/server-ce | 0.12.0 and later; before 0.12.2; before 0.11.1 | 0.12.2, 0.11.1 | Patch available | CNA |
| — | litespeed.js (npm) | before 0.3.12 | 0.3.12 | Patch available | GHSA-v9p9-535w-4285 |
| — | appwrite/server-ce (Packagist) | 0.12.0 to before 0.12.2 | 0.12.2 | Patch available | GHSA-v9p9-535w-4285 |
| — | appwrite/server-ce (Packagist) | before 0.11.1 | 0.11.1 | Patch available | GHSA-v9p9-535w-4285 |
- litespeed.js Vendor— Affected before 0.3.12 Fixed in 0.3.12 Patch available CNA
- appwrite/server-ce Vendor— Affected 0.12.0 and later; before 0.12.2; before 0.11.1 Fixed in 0.12.2, 0.11.1 Patch available CNA
- litespeed.js (npm) Vendor— Affected before 0.3.12 Fixed in 0.3.12 Patch available GHSA-v9p9-535w-4285
- appwrite/server-ce (Packagist) Vendor— Affected 0.12.0 to before 0.12.2 Fixed in 0.12.2 Patch available GHSA-v9p9-535w-4285
- appwrite/server-ce (Packagist) Vendor— Affected before 0.11.1 Fixed in 0.11.1 Patch available GHSA-v9p9-535w-4285
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:* | before 0.11.1; 0.12.0 to before 0.12.2 | Vulnerable | appwrite |
| cpe:2.3:a:litespeed.js_project:litespeed.js:*:*:*:*:*:node.js:*:* | before 0.3.12 | Vulnerable | Litespeed.js Project |
- cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:* Versions before 0.11.1; 0.12.0 to before 0.12.2 Vulnerable ·appwrite
- cpe:2.3:a:litespeed.js_project:litespeed.js:*:*:*:*:*:node.js:*:* Versions before 0.3.12 Vulnerable ·Litespeed.js Project
Remediation
- Fix · CNA litespeed.js Fixed in 0.3.12
- Fix · CNA appwrite/server-ce Fixed in 0.12.2, 0.11.1
- Fix · GHSA-v9p9-535w-4285 litespeed.js (npm) Fixed in 0.3.12 Advisory →
- Fix · GHSA-v9p9-535w-4285 appwrite/server-ce (Packagist) Fixed in 0.12.2 Advisory →
- Fix · GHSA-v9p9-535w-4285 appwrite/server-ce (Packagist) Fixed in 0.11.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23682
- 2026-10-03 Alias added: GHSA-v9p9-535w-4285
References
Sources
- CVE-2021-23682 · CVE Program
- CVE-2021-23682 · NVD
- FIRST EPSS
- GHSA-v9p9-535w-4285 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences