{"id":"CVE-2021-23470","details":"This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077","aliases":["GHSA-4g77-cvgw-grvw","SNYK-JS-PUTILMERGE-2391487"],"modified":"2026-07-08T06:49:37.509092097Z","published":"2022-02-04T20:15:08.363Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"fixed":"3.8.0"}],"source":"CPE_RANGE","vendor_product":"putil-merge_project:putil-merge","cpes":["cpe:2.3:a:putil-merge_project:putil-merge:*:*:*:*:*:*:*:*"]},{"extracted_events":[{"fixed":"3.8.0"}],"source":"DESCRIPTION"}]},"references":[{"type":"FIX","url":"https://github.com/panates/putil-merge/commit/476d00078dfb2827d7c9ee0f2392c81b864f7bc5"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JS-PUTILMERGE-2391487"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/panates/putil-merge","events":[{"introduced":"0"},{"fixed":"476d00078dfb2827d7c9ee0f2392c81b864f7bc5"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23470.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}