# CVE-2021-44908: Sails.js prototype pollution in action module loading

Source: https://junglewise.ai/threats/cve-2021-44908-sails-js-prototype-pollution-in-action-module-loading  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-44908 · Severity: low · CVSS 3.1 · Published 2022-03-18

Sails.js is a popular Node.js web framework used to build server applications. A prototype pollution vulnerability in its action module loader allows attackers to inject arbitrary properties into JavaScript objects, potentially causing application crashes or allowing property injection attacks that could bypass security controls or modify application behavior.

Technologies: [sails (npm)](https://junglewise.ai/threats/technologies/sails). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-44908 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-44908 being exploited in the wild.

**How severe is CVE-2021-44908?** Low severity, with a CVSS score of 3.1, published 18 March 2022.

**Which products and versions are affected?** sails (npm) SEMVER:introduced=0,last_affected=1.5.2; Sails.js through 1.5.2.

**Is there a fix for CVE-2021-44908?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-44908 attacked?** It is attacked over the network.

**Am I affected by CVE-2021-44908?** Check whether you run sails (npm) or Sails.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a prototype pollution flaw (CWE-1321) in the loadActionModules() function within controller/load-action-modules.js. The vulnerable code at lines 134–165 performs unsafe object assignment when processing action file paths; if an application dynamically controls the filePath variable, an attacker can supply a path traversal or specially crafted value that pollutes the JavaScript object prototype. No authentication or user interaction is required—the vulnerability is triggered via network-reachable input. An attacker can cause denial of service by crashing the application or inject arbitrary properties to bypass security controls or alter application logic. A patch is available in the master branch of the Sails.js GitHub repository.

## Affected products

- Sails.js Sails.js through 1.5.2

## Identifiers

- CVE-2021-44908
- GHSA-8v3j-jfg3-v3fv

## Timeline

- 2022-03-15: disclosed: Vulnerability reported on GitHub issue #7209
- 2022-03-17: advisory: CVE-2021-44908 published on NVD
- 2022-03-18: advisory: GHSA-8v3j-jfg3-v3fv advisory published

## References

- [https://github.com/balderdashy/sails/issues/7209](https://github.com/balderdashy/sails/issues/7209)

## Related threats

- [Sails denial of service through virtual socket request](https://junglewise.ai/threats/cve-2023-38504-sails-denial-of-service-through-virtual-socket-request)
- [Sails denial of service via undefined route OPTIONS request](https://junglewise.ai/threats/sails-denial-of-service-via-undefined-route-options-request-1aa4d10c)
- [Sails framework broken CORS configuration validation](https://junglewise.ai/threats/cve-2016-10549-sails-framework-broken-cors-configuration-validation)