MooTools: version with known vulnerabilities

best_practices.vulnerable_libraries.mootools

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, vulnerable libraries

What the rule checks

Scope. Applies to pages on which the library is detected: its window global (with its version field) or, for jQuery, Bootstrap, AngularJS, Lodash and Handlebars, a script URL whose path names the library and a version.

Expectation. Fails for every detected MooTools version: known advisories (CVE-2021-32821, CVE-2021-23432) have no patch, and the last release 1.6.0 is unmaintained, so no fixed line exists (OWASP A06). There is no conforming version; the negative is a look-alike: an application namespace that only shares part of the name is not `MooTools.version`. A page without the library: not applicable. A page that breaks the detection scripts (result missing or malformed) is not run for every library, never clean.

Source. retire.js jsrepository-v4.json (GitHub/NVD advisories), reviewed 2026-11-02 against GHSA-v63q-hgqc-qvpg and NVD; CVE-2021-32821, CVE-2021-23432 (no patch); unmaintained since 1.6.0 (2016); OWASP Top 10 A06 (unsupported components)

Detection: analyze_vulnerable_libraries; needs dom.

Failing example

The check reports a violation here. Corpus case vulnerable_libs_outdated_underscore_and_legacy. The page may contain further findings for other rules.

vulnerable_libs_outdated_underscore_and_legacy.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Outdated Underscore, Prototype and MooTools</title>
  <script>
    // Underscore shares `_` with Lodash and lacks `_.runInContext`.
    window._ = { VERSION: "1.12.0" };
    // Unmaintained: every release is flagged.
    window.Prototype = { Version: "1.7.3" };
    window.MooTools = { version: "1.6.0" };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>Outdated Underscore, Prototype and MooTools</h1>

  </main>
</body>
</html>

Passing example

The check reports nothing here. Corpus case vulnerable_libs_lookalikes. The page may contain further findings for other rules.

vulnerable_libs_lookalikes.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Plugins and namespaces that look like libraries</title>
  <!-- Plugins carry their own version, not the library's. -->
  <script src="/ui/1.12.1/jquery-ui.min.js"></script>
  <script src="/js/jquery.validate-1.19.5.min.js"></script>
  <script src="/js/bootstrap-datepicker-1.9.0.min.js"></script>
  <!-- Angular 2+ is not AngularJS. -->
  <script type="module" src="/npm/@angular/core@17.3.0/fesm2022/core.mjs"></script>
  <script>
    // An application class and namespace that only share a name.
    window.Prototype = class Prototype { constructor() { this.screens = []; } };
    window.MooToolsMigration = { done: true, version: "2.0.0" };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>Plugins and namespaces that look like libraries</h1>

  </main>
</body>
</html>

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.