CVE-2021-23413: Jszip Project Jszip

Medium severity, CVSS 5.3. EPSS: 3.4% chance of exploitation in the next 30 days.

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

Affected products

• Jszip Project Jszip: before 3.7.0 (fixed in 3.7.0)

Published 2021-07-25. Last modified 2026-06-17.