CVE-2021-23444

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.

• CWE-843

• https://github.com/clientIO/joint/commit/e5bf89efef6d5ea572d66870ffd86560de7830a8Patch, Third Party Advisory
• https://github.com/clientIO/joint/pull/1514Third Party Advisory
• https://github.com/clientIO/joint/releases/tag/v3.4.2Release Notes, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1655817Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1655816Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-JOINTJS-1579578Exploit, Third Party Advisory
• https://github.com/clientIO/joint/commit/e5bf89efef6d5ea572d66870ffd86560de7830a8Patch, Third Party Advisory
• https://github.com/clientIO/joint/pull/1514Third Party Advisory
• https://github.com/clientIO/joint/releases/tag/v3.4.2Release Notes, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1655817Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1655816Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-JOINTJS-1579578Exploit, Third Party Advisory

Published

Sep 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23439This affects the package file-upload-with-preview before 4.2…6.1
• CVE-2021-2344Vulnerability in the Oracle Coherence product of Oracle Fusi…7.5
• CVE-2021-23440This affects the package set-value before <2.0.1, >=3.0.0 <4…9.8
• CVE-2021-23441Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-23442This affects all versions of package @cookiex/deep. The glob…9.8
• CVE-2021-23443This affects the package edge.js before 5.3.2. A type confus…6.1
• CVE-2021-23445This affects the package datatables.net before 1.11.3. If an…6.1
• CVE-2021-23446The package handsontable before 10.0.0; the package handsont…7.5
• CVE-2021-23447This affects the package teddy before 0.5.9. A type confusio…6.1
• CVE-2021-23448All versions of package config-handler are vulnerable to Pro…9.8
• CVE-2021-23449This affects the package vm2 before 3.9.4 via a Prototype Po…10
• CVE-2021-2345Vulnerability in the Oracle Commerce Guided Search / Oracle …5.4