Is CVE-2021-39227 actively exploited?

No active exploitation of CVE-2021-39227 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-39227 be exploited remotely?

Yes. CVE-2021-39227 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-39227?

CVE-2021-39227 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2021-39227

CRITICAL

CVE-2021-39227

CWE-1321Published: September 17, 2021· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.

NVD Source

Technical Analysis

CVE-2021-39227 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.