Read the docs
TI-2021-16612 Aliases CVE-2021-39227GHSA-fhv8-fx5f-7fxf

Fix prototype pollution in the zrender merge and clone helper methods

Priority MEDIUM 45CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-915.

Summary

ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.

Why it matters now

EPSS 0.01266 69th percentileScored 2026-11-07
Fix Fixed zrender (ecomfe): 5.2.1zrender (npm): 5.2.1, 4.3.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ecomfezrenderbefore 5.2.15.2.1Patch availableCNA
—zrender (npm)5.0.0 to before 5.2.15.2.1Patch availableGHSA-fhv8-fx5f-7fxf
—zrender (npm)before 4.3.34.3.3Patch availableGHSA-fhv8-fx5f-7fxf
  • zrender Vendorecomfe Affected before 5.2.1 Fixed in 5.2.1 Patch available CNA
  • zrender (npm) Vendor— Affected 5.0.0 to before 5.2.1 Fixed in 5.2.1 Patch available GHSA-fhv8-fx5f-7fxf
  • zrender (npm) Vendor— Affected before 4.3.3 Fixed in 4.3.3 Patch available GHSA-fhv8-fx5f-7fxf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:baidu:zrender:*:*:*:*:*:*:*:*before 5.2.1VulnerableBaidu
  • cpe:2.3:a:baidu:zrender:*:*:*:*:*:*:*:* Versions before 5.2.1 Vulnerable ·Baidu

Remediation

  • Fix · CNA zrender (ecomfe) Fixed in 5.2.1
  • Fix · GHSA-fhv8-fx5f-7fxf zrender (npm) Fixed in 5.2.1 Advisory →
  • Fix · GHSA-fhv8-fx5f-7fxf zrender (npm) Fixed in 4.3.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39227
  2. 2026-10-03 Alias added: GHSA-fhv8-fx5f-7fxf

References

Patch 1

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences