Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
MEDIUM severity

Prototype Pollution in the merge and clone helper methodsGHSA-fhv8-fx5f-7fxf

MEDIUMFix: ecomfe/zrender#826

GHSA-fhv8-fx5f-7fxf is a medium-severity (CVSS 6.2) CWE-1321 vulnerability in zrender. A fix is available for zrender — see the affected versions and patch details below.

Also known asCVE-2021-39227
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Sep 30, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs71th percentile — riskier than 71% of all scored CVEsHighest risk
0.00%0.63%1.26%1.89%0.4%1.4%Apr 26Jul 26Sep 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-fhv8-fx5f-7fxf by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

277other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
zrendernpm
6.3Mdownloads / week

Description

ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using merge and clone helper methods in the src/core/util.ts module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is __proto__ in the object keys. Omit it before using it as an parameter in these affected methods. Or in echarts.util.merge and setOption if project is using ECharts.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npmzrender≥ 5.0.0&&< 5.2.15.2.1npm install zrender@5.2.1
📦npmzrenderall versions4.3.3npm install zrender@4.3.3

Affected Products

1 product · 1 configurations
Application
zrenderbaidu
< 5.2.1
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for zrender, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update zrender to 5.2.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-fhv8-fx5f-7fxf is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact Using `merge` and `clone` helper methods in the `src/core/util.ts` module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly. ### Patches It has been patched in https://github.com/ecomfe/zrender/pull/826. Users should update zrender to `5.2.1`. and update echarts to `5.2.1` if project is using echarts. ### References NA ### For more information NA
O3 Security · Impact-Aware SCA

Is GHSA-fhv8-fx5f-7fxf in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Prototype Pollution in the merge and clone helper methods