{"id":"CVE-2021-23682","details":"This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.","aliases":["GHSA-v9p9-535w-4285"],"modified":"2026-11-11T10:45:11.339927071Z","published":"2022-02-16T17:15:10.713Z","related":["SNYK-JS-LITESPEEDJS-2359250","SNYK-PHP-APPWRITESERVERCE-2401820"],"database_specific":{"unresolved_ranges":[{"vendor_product":"litespeed.js_project:litespeed.js","cpes":["cpe:2.3:a:litespeed.js_project:litespeed.js:*:*:*:*:*:node.js:*:*"],"extracted_events":[{"range":[{"fixed":"0.3.12"}],"source":"CPE_RANGE"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/appwrite/appwrite/releases/tag/0.11.1"},{"type":"ADVISORY","url":"https://github.com/appwrite/appwrite/releases/tag/0.12.2"},{"type":"FIX","url":"https://github.com/appwrite/appwrite/pull/2778"},{"type":"FIX","url":"https://github.com/litespeed-js/litespeed.js/pull/18"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/appwrite/appwrite","events":[{"introduced":"0"},{"fixed":"3c399b158ae2a785869ac9dfa059b53dba651da1"},{"introduced":"1a0f740459fde58dc41112861f47bc06d1ae5c4c"},{"fixed":"4de45b71421756e22a9672add45580f60acb2907"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"0.11.1"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*","range":[{"introduced":"0.12.0"},{"fixed":"0.12.2"}]},{"range":[{"fixed":"3c399b158ae2a785869ac9dfa059b53dba651da1"}],"source":"REFERENCES_TAG","original_tag":"0.11.1"},{"range":[{"fixed":"4de45b71421756e22a9672add45580f60acb2907"}],"source":"REFERENCES_TAG","original_tag":"0.12.2"}]}}],"versions":["0.12.1","0.12.0","0.10.4","0.10.3","0.10.2","0.10.1","0.10.0","0.9.3","0.9.2","0.9.1","0.9.0","0.9","0.8.0","0.7.2","0.7.1","0.7.0","0.6.2","0.6.0","0.5.3","0.5.2","0.5.1","0.5.0","0.4.0","0.3.0","0.2.0","0.1.15","0.1.13"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23682.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}