CVE-2022-21189

CVE-2022-21189 is a critical Prototype Pollution vulnerability affecting Dexie versions before 3.2.2 and specific alpha versions of 4.0.0. It allows an attacker to manipulate the Object.prototype by injecting malicious key paths (like __proto__) into the Dexie.setByKeyPath function, potentially leading to arbitrary property modification. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network with low complexity and no user interaction, enabling full compromise of confidentiality, integrity, and availability. Despite its severity, there is currently no evidence of active exploitation, public exploit code, or significant community discussion, as indicated by its low EPSS score and lack of media coverage.