CVE-2021-23558

The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)

• CWE-1321

• https://github.com/b-heilman/bmoor/commit/29b0162cc1dc1791fc060891f568b0ae29bc542bPatch, Third Party Advisory
• https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation/Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-BMOOR-2342622Exploit, Third Party Advisory
• https://github.com/b-heilman/bmoor/commit/29b0162cc1dc1791fc060891f568b0ae29bc542bPatch, Third Party Advisory
• https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation/Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-BMOOR-2342622Exploit, Third Party Advisory

Published

Jan 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2353Vulnerability in the Siebel Core - Server Framework product …4.4
• CVE-2021-2354Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23543All versions of package realms-shim are vulnerable to Sandbo…9.8
• CVE-2021-2355Vulnerability in the Oracle Marketing product of Oracle E-Bu…9.1
• CVE-2021-23555The package vm2 before 3.9.6 are vulnerable to Sandbox Bypas…9.8
• CVE-2021-23556The package guake before 3.8.5 are vulnerable to Exposed Dan…8
• CVE-2021-2356Vulnerability in the MySQL Server product of Oracle MySQL (c…5.9
• CVE-2021-23561All versions of package comb are vulnerable to Prototype Pol…9.8
• CVE-2021-23562This affects the package plupload before 2.3.9. A file name …8.8
• CVE-2021-23566The package nanoid from 3.0.0 and before 3.1.31 are vulnerab…5.5
• CVE-2021-23567The package colors after 1.4.0 are vulnerable to Denial of S…7.5
• CVE-2021-23568The package extend2 before 1.0.1 are vulnerable to Prototype…9.8