CVE

CVE-2021-41097

9.1

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

path

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

Aurelia-Path < 1.1.7 - Prototype Pollution

Aurelia-path before 1.1.7 contains a prototype pollution caused by parsing malicious URL parameters, letting attackers modify Object.prototype, exploit requires the application to parse user-controlled URLs. References: https://github.com/aurelia/path/issues/44 https://security.snyk.io/vuln/SNYK-JS-AURELIAPATH-1579475 https://nvd.nist.gov/vuln/detail/CVE-2021-41097 Remediation: Aurelia-path parseQueryString function was found vulnerable to prototype pollution via crafted __proto__ URL parameters.

url

Scanner page →Run scanner

CVE history: path

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →