CVEs-PoC/2021/CVE-2021-43138.md

CVE-2021-43138

Description

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

POC

Reference

No PoCs from references.

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/MaySoMusician/geidai-ikoi
• https://github.com/seal-community/patches