TI-2022-05585 Aliases CVE-2022-21189 GHSA-3xgx-r9j4-qw9w

Prototype pollution in dexie

MEDIUM 45CWE-1321Published 2022-05-01 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This can allow an attacker to add/modify properties of the Object.prototype leading to prototype pollution vulnerability. **Note:** This vulnerability can occur in multiple ways, for example when modifying a collection with untrusted user input.

Why it matters now

EPSS 0.0171 77th percentileScored 2026-11-07

Fix Fixed dexie: 3.2.2, 4.0.0-alpha.3dexie (npm): 3.2.2, 4.0.0-alpha.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	dexie	before 3.2.2; 4.0.0-alpha.1 and later; before 4.0.0-alpha.3	3.2.2, 4.0.0-alpha.3	Patch available	CNA
—	dexie (npm)	before 3.2.2	3.2.2	Patch available	GHSA-3xgx-r9j4-qw9w
—	dexie (npm)	4.0.0-alpha.1 to before 4.0.0-alpha.3	4.0.0-alpha.3	Patch available	GHSA-3xgx-r9j4-qw9w

dexie Vendor— Affected before 3.2.2; 4.0.0-alpha.1 and later; before 4.0.0-alpha.3 Fixed in 3.2.2, 4.0.0-alpha.3 Patch available CNA
dexie (npm) Vendor— Affected before 3.2.2 Fixed in 3.2.2 Patch available GHSA-3xgx-r9j4-qw9w
dexie (npm) Vendor— Affected 4.0.0-alpha.1 to before 4.0.0-alpha.3 Fixed in 4.0.0-alpha.3 Patch available GHSA-3xgx-r9j4-qw9w

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:dexie:dexie::::::node.js::*	before 3.2.2	Vulnerable	Dexie
cpe:2.3:a:dexie:dexie:4.0.0:alpha1::::::	4.0.0 alpha1	Vulnerable	Dexie
cpe:2.3:a:dexie:dexie:4.0.0:alpha2::::::	4.0.0 alpha2	Vulnerable	Dexie

cpe:2.3:a:dexie:dexie:*:*:*:*:*:node.js:*:* Versions before 3.2.2 Vulnerable ·Dexie
cpe:2.3:a:dexie:dexie:4.0.0:alpha1:*:*:*:*:*:* Versions 4.0.0 alpha1 Vulnerable ·Dexie
cpe:2.3:a:dexie:dexie:4.0.0:alpha2:*:*:*:*:*:* Versions 4.0.0 alpha2 Vulnerable ·Dexie

Remediation

Fix · CNA dexie Fixed in 3.2.2, 4.0.0-alpha.3
Fix · GHSA-3xgx-r9j4-qw9w dexie (npm) Fixed in 3.2.2 Advisory →
Fix · GHSA-3xgx-r9j4-qw9w dexie (npm) Fixed in 4.0.0-alpha.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-21189
2026-10-03 Alias added: GHSA-3xgx-r9j4-qw9w

References

Patch 1

https://github.com/dexie/Dexie.js/commit/1d655a69b9f28c3af6fae10cf5c61df387dc689b

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-21189

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences