Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helper
Priority LOW 35CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-915.
Summary
think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3.
Why it matters now
EPSS 0.01009 63rd percentileScored 2026-11-07
Fix Fixed think-helper (thinkjs): 1.1.3think-helper (npm): 1.1.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| thinkjs | think-helper | before 1.1.3 | 1.1.3 | Patch available | CNA |
| — | think-helper (npm) | before 1.1.3 | 1.1.3 | Patch available | GHSA-vr5m-3h59-7jcp |
- think-helper Vendorthinkjs Affected before 1.1.3 Fixed in 1.1.3 Patch available CNA
- think-helper (npm) Vendor— Affected before 1.1.3 Fixed in 1.1.3 Patch available GHSA-vr5m-3h59-7jcp
Remediation
- Fix · CNA think-helper (thinkjs) Fixed in 1.1.3
- Fix · GHSA-vr5m-3h59-7jcp think-helper (npm) Fixed in 1.1.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32736
- 2026-10-03 Alias added: GHSA-vr5m-3h59-7jcp
References
Sources
- CVE-2021-32736 · CVE Program
- CVE-2021-32736 · NVD
- FIRST EPSS
- GHSA-vr5m-3h59-7jcp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences