CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- manuelstofer json-pointerPrototype Pollution6.0 Medium
- safetydance project safetydancePrototype Pollution7.3 High
- bmoor project bmoorPrototype Pollution7.3 High
- typeormTypeORM vulnerable to MAID and Prototype Pollution9.8 Critical
- apache struts, oracle communications policy management, financial services data integration hub +2 more +4 moreImproperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts9.8 Critical
mergifynpmPrototype Pollution in mergifyNo score@hapi/hoeknpmPrototype Pollution in @hapi/hoekNo scorenotevilnpmSandbox Breakout / Prototype Pollution in notevilNo scoresahmatnpmPrototype Pollution in sahmatNo scoresafe-object2npmPrototype Pollution in safe-object2No scoregetsetdeepnpmPrototype Pollution in getsetdeepNo scoredeep-setternpmPrototype Pollution in deep-setterNo scoreget-setternpmPrototype Pollution in get-setterNo scorereggaenpmPrototype Pollution in reggaeNo scoreunflattennpmPrototype Pollution in unflattenNo scoreflat-wrapnpmPrototype Pollution in flat-wrapNo scoremithrilnpmPrototype Pollution in mithrilNo scorelodash.mergewithnpmPrototype Pollution in lodash.mergewithNo scorelodash.defaultsdeepnpmPrototype Pollution in lodash.defaultsdeepNo scorelodash.mergewithnpmPrototype Pollution in lodash.mergewithNo scorelodash.defaultsdeepnpmPrototype Pollution in lodash.defaultsdeepNo scorelodash.mergenpm,@rootio/lodash.mergeRoot +1 morePrototype Pollution in lodash.mergeNo score@commercial/subtextnpmPrototype Pollution in @commercial/subtextNo score@hapi/peznpmPrototype Pollution in @hapi/subtextNo scorepeznpmPrototype Pollution in pezNo scoresmart-extendnpmPrototype Pollution in smart-extendNo scoremerge-objectsnpmPrototype Pollution in merge-objectsNo score- guidesmiths worksmithPrototype Pollution9.8 Critical
- safe-object2 project safe-object2Prototype Pollution9.8 Critical
- gedi project gediPrototype Pollution9.8 Critical
- yola promisehelpersPrototype Pollution9.8 Critical
- tiny-conf project tiny-confPrototype Pollution9.8 Critical
- node-oojs project node-oojsPrototype Pollution9.8 Critical
- nodee-utils project nodee-utilsPrototype Pollution9.8 Critical
- digital bazaar node-forge, digitalbazaar forge +1 morePrototype Pollution9.8 Critical
- locutusPrototype Pollution9.8 Critical
- dot-notes project dot-notesPrototype Pollution9.8 Critical
- gammautils project gammautilsPrototype Pollution9.8 Critical
- realseriousgames confuciousPrototype Pollution9.8 Critical
- deep-get-set project deep-get-setPrototype Pollution9.8 Critical
- invertase deepsPrototype Pollution9.8 Critical
- arr-flatten-unflatten project arr-flatten-unflattenPrototype Pollution9.8 Critical
- irrelon irrelon-path, \@irrelon\/path +1 morePrototype Pollution9.8 Critical
- property-expr project property-exprPrototype Pollution9.8 Critical
- connie-lang project connie-langPrototype Pollution9.8 Critical
- linux-cmdline project linux-cmdlinePrototype Pollution9.8 Critical
- nis-utils project nis-utilsPrototype Pollution9.8 Critical
- templ8 project templ8Prototype Pollution9.8 Critical
- springtree madlib-object-utilsPrototype Pollution9.8 Critical
- php.js project php.jsPrototype Pollution9.8 Critical
- Show moreLoading…