Is CVE-2021-23771 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-23771 being exploited in the wild.

How severe is CVE-2021-23771?

Low severity, with a CVSS score of 3.1, published 18 March 2022.

Which products and versions are affected?

argencoders-notevil (npm) SEMVER:introduced=0,last_affected=2.5.0; notevil (npm) SEMVER:introduced=0,last_affected=1.3.3.

Is there a fix for CVE-2021-23771?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-23771 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-23771?

Check whether you run argencoders-notevil (npm) or notevil (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-23771: notevil sandbox escape via prototype pollution

CVE-2021-23771 · Severity: low · CVSS 3.1 · Published 2022-03-18

notevil is a JavaScript library designed to safely evaluate arbitrary code in a restricted sandbox environment. This vulnerability allows attackers to break out of the sandbox and pollute object prototypes, potentially leading to code execution or data manipulation in applications that use this library.

Technologies: notevil (npm). Vendors: npm.

Quick answers

Is CVE-2021-23771 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-23771 being exploited in the wild.
How severe is CVE-2021-23771?: Low severity, with a CVSS score of 3.1, published 18 March 2022.
Which products and versions are affected?: argencoders-notevil (npm) SEMVER:introduced=0,last_affected=2.5.0; notevil (npm) SEMVER:introduced=0,last_affected=1.3.3.
Is there a fix for CVE-2021-23771?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-23771 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-23771?: Check whether you run argencoders-notevil (npm) or notevil (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a sandbox escape leading to prototype pollution (CWE-1321). The package fails to properly restrict access to the main JavaScript context, allowing an attacker to add or modify an object's prototype and escape the sandbox restrictions. This vulnerability resulted from an incomplete fix to a prior sandbox escape issue (SNYK-JS-NOTEVIL-608878). No network or authentication is required; an attacker can exploit this by providing untrusted code to be evaluated by the library. The package has been deprecated and is no longer maintained.

Affected products

notevil notevil all versions up to 1.3.3
argencoders argencoders-notevil all versions up to 2.5.0

Identifiers

CVE-2021-23771
GHSA-8g4m-cjm2-96wq

Timeline

2022-03-18: disclosed: GHSA-8g4m-cjm2-96wq published
2021-12-28: other: notevil repository archived; package marked as no longer maintained

References

https://github.com/mmckegg/notevil

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.