CVE-2021-23771

This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878).

• CWE-1321

• https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946Exploit, Third Party Advisory

Published

Mar 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2374Vulnerability in the MySQL Server product of Oracle MySQL (c…4.1
• CVE-2021-2375Vulnerability in the JD Edwards EnterpriseOne Tools product …6.1
• CVE-2021-23758All versions of package ajaxpro.2 are vulnerable to Deserial…9.8
• CVE-2021-2376Vulnerability in the Oracle WebLogic Server product of Oracl…7.5
• CVE-2021-23760The package keyget from 0.0.0 are vulnerable to Prototype Po…9.8
• CVE-2021-2377Vulnerability in the PeopleSoft Enterprise PeopleTools produ…4.3
• CVE-2021-23772This affects all versions of package github.com/kataras/iris…8.8
• CVE-2021-2378Vulnerability in the Oracle WebLogic Server product of Oracl…7.5
• CVE-2021-23784This affects the package tempura before 0.4.0. If the input …6.1
• CVE-2021-23792The package com.twelvemonkeys.imageio:imageio-metadata befor…9.8
• CVE-2021-23797All versions of package http-server-node are vulnerable to D…9.8
• CVE-2021-2380Vulnerability in the Oracle Applications Framework product o…7.6