CVE-2021-41097

    Dashboard / Vulnerabilities / CVE-2021-41097

    CVE-2021-41097

    Published: 27 Sept 2021Last Modified: 9 Jul 2026

    Summary:

    Details: aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`.

    References: https://github.com/aurelia/path/releases/tag/1.1.7, https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv, https://www.npmjs.com/package/aurelia-path, https://github.com/aurelia/path/issues/44, https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -3c674eff2ba3856f0f132503fec78597666b2b7e

    Affected versions

    1.1.5
    1.1.4
    1.1.3
    1.1.2
    1.1.1
    1.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41097 | CVE-DB