CVE-2022-21190

This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.__proto__ or foo.this.constructor.prototype.

• CWE-1321

• https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808Exploit, Third Party Advisory
• https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571Broken Link, Patch, Third Party Advisory
• https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07Broken Link, Release Notes, Tool Signature
• https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75Patch, Tool Signature
• https://snyk.io/vuln/SNYK-JS-CONVICT-2774757Exploit, Third Party Advisory
• https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808Exploit, Third Party Advisory
• https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571Broken Link, Patch, Third Party Advisory
• https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07Broken Link, Release Notes, Tool Signature
• https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75Patch, Tool Signature
• https://snyk.io/vuln/SNYK-JS-CONVICT-2774757Exploit, Third Party Advisory

Published

May 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21185Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-21186The package @acrontum/filesystem-template before 0.0.2 are v…9.8
• CVE-2022-21187The package libvcs before 0.11.1 are vulnerable to Command I…9.8
• CVE-2022-21188Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-21189The package dexie before 3.2.2, from 4.0.0-alpha.1 and befor…9.8
• CVE-2022-2119OFFIS DCMTK's (All versions prior to 3.6.7) service class pr…9.8
• CVE-2022-21191Versions of the package global-modules-path before 3.0.0 are…9.8
• CVE-2022-21192All versions of the package serve-lite are vulnerable to Dir…7.5
• CVE-2022-21193Directory traversal vulnerability in TransmitMail 2.5.0 to 2…7.5
• CVE-2022-21194The following Yokogawa Electric products do not change the p…9.8
• CVE-2022-21195All versions of package url-regex are vulnerable to Regular …7.5
• CVE-2022-21196MMP: All versions prior to v1.0.3, PTP C-series: Device vers…9.8