CVE:CVE-2021-23771
CNNVD:CNNVD-202203-1584
notevil是一个开源的npm包。
notevil 存在注入漏洞，该漏洞源于未能限制对主上下文的访问，从而允许攻击者添加或修改对象的原型。容易受到沙盒逃逸的影响，从而导致原型污染。
solution:Upgrade argencoders-notevil_project argencoders-notevil to a higher version than 2.5.0,and avoid the version (,2.5.0]; Upgrade notevil_project notevil to a higher version than 1.3.3,and avoid the version (,1.3.3]