CVE-2021-39227

ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.

• CWE-1321
• CWE-1321

• https://github.com/ecomfe/zrender/pull/826Patch, Third Party Advisory
• https://github.com/ecomfe/zrender/releases/tag/5.2.1Release Notes, Third Party Advisory
• https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxfThird Party Advisory
• https://github.com/ecomfe/zrender/pull/826Patch, Third Party Advisory
• https://github.com/ecomfe/zrender/releases/tag/5.2.1Release Notes, Third Party Advisory
• https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxfThird Party Advisory

Published

Sep 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39221Nextcloud is an open-source, self-hosted productivity platfo…5.4
• CVE-2021-39222Nextcloud is an open-source, self-hosted productivity platfo…6.1
• CVE-2021-39223Nextcloud is an open-source, self-hosted productivity platfo…5.3
• CVE-2021-39224Nextcloud is an open-source, self-hosted productivity platfo…5.3
• CVE-2021-39225Nextcloud is an open-source, self-hosted productivity platfo…8.1
• CVE-2021-39226Grafana is an open source data visualization platform. In af…7.3
• CVE-2021-39228Tremor is an event processing system for unstructured data. …9.8
• CVE-2021-39229Apprise is an open source library which allows you to send a…7.5
• CVE-2021-3923A flaw was found in the Linux kernel's implementation of RDM…2.3
• CVE-2021-39230Butter is a system usability utility. Due to a kernel error …6.5
• CVE-2021-39231In Apache Ozone versions prior to 1.2.0, Various internal se…9.1
• CVE-2021-39232In Apache Ozone versions prior to 1.2.0, certain admin relat…8.8