Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-x5xx-ttsg-4bb8
Vulnerability ID VCID-x5xx-ttsg-4bb8
Aliases CVE-2021-4278
GHSA-mw4x-g2x8-qcvf
Summary
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2021-4278
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2021-4278
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2021-4278
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2021-4278
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-mw4x-g2x8-qcvf
cvssv3.1 7.8 https://github.com/cronvel/tree-kit
generic_textual HIGH https://github.com/cronvel/tree-kit
cvssv3.1 7.8 https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd
generic_textual HIGH https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd
cvssv3.1 7.8 https://github.com/cronvel/tree-kit/releases/tag/v0.7.0
generic_textual HIGH https://github.com/cronvel/tree-kit/releases/tag/v0.7.0
cvssv3.1 7.8 https://nvd.nist.gov/vuln/detail/CVE-2021-4278
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-4278
cvssv3.1 7.8 https://vuldb.com/?ctiid.216765
generic_textual HIGH https://vuldb.com/?ctiid.216765
cvssv3.1 7.8 https://vuldb.com/?id.216765
generic_textual HIGH https://vuldb.com/?id.216765
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-4278
https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd
https://github.com/cronvel/tree-kit/releases/tag/v0.7.0
https://nvd.nist.gov/vuln/detail/CVE-2021-4278
https://vuldb.com/?ctiid.216765
https://vuldb.com/?id.216765
GHSA-mw4x-g2x8-qcvf https://github.com/advisories/GHSA-mw4x-g2x8-qcvf
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/cronvel/tree-kit
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/cronvel/tree-kit/releases/tag/v0.7.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-4278
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://vuldb.com/?ctiid.216765
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://vuldb.com/?id.216765
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.27166
EPSS Score 0.00099
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-12T02:04:35.549374+00:00 EPSS Importer Import https://epss.cyentia.com/epss_scores-current.csv.gz 38.6.0