CVE-2021-41097

aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`.

• CWE-1321
• CWE-1321

• https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1Patch, Third Party Advisory
• https://github.com/aurelia/path/issues/44Exploit, Issue Tracking, Third Party Advisory
• https://github.com/aurelia/path/releases/tag/1.1.7Release Notes, Third Party Advisory
• https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwvMitigation, Third Party Advisory
• https://www.npmjs.com/package/aurelia-pathProduct, Third Party Advisory
• https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1Patch, Third Party Advisory
• https://github.com/aurelia/path/issues/44Exploit, Issue Tracking, Third Party Advisory
• https://github.com/aurelia/path/releases/tag/1.1.7Release Notes, Third Party Advisory
• https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwvMitigation, Third Party Advisory
• https://www.npmjs.com/package/aurelia-pathProduct, Third Party Advisory

Published

Sep 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41091Moby is an open-source project created by Docker to enable s…6.3
• CVE-2021-41092Docker CLI is the command line interface for the docker cont…7.5
• CVE-2021-41093Wire is an open source secure messenger. In affected version…9.8
• CVE-2021-41094Wire is an open source secure messenger. Users of Wire by Bu…4.6
• CVE-2021-41095Discourse is an open source discussion platform. There is a …6.1
• CVE-2021-41096Rucky is a USB HID Rubber Ducky Launch Pad for Android. Vers…7.5
• CVE-2021-41098Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader p…7.5
• CVE-2021-41099Redis is an open source, in-memory database that persists on…7.5
• CVE-2021-4110mruby is vulnerable to NULL Pointer Dereference7.5
• CVE-2021-41100Wire-server is the backing server for the open source wire s…9.8
• CVE-2021-41101wire-server is an open-source back end for Wire, a secure co…5.7
• CVE-2021-41103containerd is an open source container runtime with an empha…7.8