CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- express-fileupload project express-fileupload, netapp max data +1 morePrototype Pollution7.5 High
- ajv.js ajvPrototype Pollution in Ajv5.6 Medium
- lodash, oracle banking corporate lending process management, banking credit facilities process management +15 more +17 morePrototype Pollution in lodash7.4 High
- casperjsPrototype Pollution7.3 High
- typo3, typo3 cms +1 moreImproperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS8.7 High
- fun-map project fun-mapUncontrolled Resource Consumption in fun-map8.1 High
- idea paypal-adaptivePrototype pollution in paypal-adaptive5.3 Medium
- beakerbrowser beakerBeaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This...10.0 Critical
- moxa sdsPrototype Pollution in sds5.3 Medium
- express-mock-middleware project express-mock-middlewareImproperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware5.3 Medium
- dot project doteivindfjeldstad-dot contains prototype pollution vulnerability5.3 Medium
- confinit project confinitconfinit vulnerable to prototype pollution5.3 Medium
- class-transformer project class-transformerPrototype pollution in class-transformer5.3 Medium
- ini-parser project ini-parserPrototype Pollution4.4 Medium
- yargs yargs-parseryargs-parser Vulnerable to Prototype Pollution5.3 Medium
- querymen project querymenImproperly Controlled Modification of Dynamically-Determined Object Attributes in querymen5.3 Medium
- xcritical.software utilitifyImproperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify8.8 High
- substack minimist, opensuse leap +1 morePrototype Pollution in minimist5.6 Medium
- dojo, debian linux, oracle communications application session controller +7 more +9 morePrototype pollution in dojo7.7 High
- vega project vegaImproperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util4.3 Medium
- dot-prop project dot-propdot-prop Prototype Pollution vulnerability7.3 High
- sugarcrmSugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration...7.2 High
- sugarcrmSugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a...8.8 High
- sugarcrmSugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard...7.2 High
- rpyc project rpycDuplicate Advisory: Possible remote code execution via a remote procedure call7.5 High
- set-value project set-valuePrototype Pollution in set-value9.8 Critical
- assign-deep project assign-deepassign-deep Vulnerable to Prototype Pollution7.5 High
- fasterxml jackson-databind, apple xcode, debian linux +21 more +23 moreDeserialization of untrusted data in FasterXML jackson-databind9.8 Critical
- lodash, f5 big-ip access policy manager, big-ip advanced firewall manager +18 more +20 morePrototype Pollution in lodash9.1 Critical
- angularjsCross-Site Scripting via JSONP7.5 High
@apollo/gatewaynpmPrototype Pollution in @apollo/gateway7.3 HighquerystringifynpmPrototype Pollution in querystringifyNo score- cure53 dompurifyDOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING5.1 Medium
- cure53 dompurifyDOMPurify before 3.3.2 Mutation XSS via Re-Contextualization5.3 Medium
- cure53 dompurifyDOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES5.1 Medium
- cure53 dompurifyDOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR5.1 Medium
- cure53 dompurifyDOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS5.1 Medium
- cure53 dompurifyDOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags5.3 Medium
- cure53 dompurifyDOMPurify before 3.4.9 Trusted Types Policy State Contamination5.1 Medium
- cure53 dompurifyDOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig5.1 Medium
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +53 more +55 morefast-uri vulnerable to host confusion via percent-encoded authority delimiters7.5 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +32 more +34 morefast-uri vulnerable to path traversal via percent-encoded dot segments7.5 High
- chimurai http-proxy-middlewarehttp-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass6.9 Medium
- cure53 dompurifyDOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content6.3 Medium
- cure53 dompurifyDOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM6.1 Medium
- cure53 dompurifyDOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks6.1 Medium
- cure53 dompurifyDOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)6.0 Medium
- cure53 dompurifyDOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode6.8 Medium
- cure53 dompurifyDOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback6.9 Medium
- chimurai http-proxy-middlewareArbitrary Code Execution in handlebars4.0 Medium
- Show moreLoading…