High severity · published Feb 24, 2022
CVE-2022-21824
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously…
8.2
CVSS
21.5%
EPSS
No
On KEV
Description
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)21.5% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
10.0; 11.0 · source: NVD
MC
Mysql Cluster · Oracle
through 8.0.29 · source: NVD
MC
Mysql Connectors · Oracle
through 8.0.28 · source: NVD
ME
Mysql Enterprise Monitor · Oracle
through 8.0.29 · source: NVD
MS
Mysql Server · Oracle
through 8.0.29 · source: NVD
MW
Mysql Workbench · Oracle
through 8.0.28 · source: NVD
NO
Node.js · Nodejs
12.0.0 before 12.22.9; 14.0.0 before 14.18.3; 16.0.0 before 16.13.2; 17.0.0 before 17.3.1 · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
OW
Oncommand Workflow Automation · Netapp
All versions, or not specified · source: NVD
PE
Peoplesoft Enterprise Peopletools · Oracle
8.58; 8.59 · source: NVD
SN
Snapcenter · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-21824
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-21824
Issue Tracking
https://hackerone.com/reports/1431042
Mailing List
https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
Release Notes
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220325-0007/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220729-0004/
Third Party Advisory
https://www.debian.org/security/2022/dsa-5170
More from Debian Linux
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability
