CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- substack minimistPrototype Pollution in minimist9.8 Critical
- sailsjs sailsPrototype Pollution in Sails.js9.8 Critical
- ahdinosaur set-inPrototype Pollution8.6 High
- libnested project libnestedPrototype Pollution7.5 High
- argencoders-notevil project argencoders-notevil, notevil project notevil +1 moreSandbox Bypass6.5 Medium
- bodymen project bodymenPrototype Pollution6.3 Medium
- atlassian crucible, fisheye +1 moreThe jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote...6.1 Medium
- parse-community parse-serverCommand Injection in Parse server10.0 Critical
- jquery.cookie project jquery.cookiePrototype Pollution in jquery.cookie6.1 Medium
- object-extend project object-extendPrototype Pollution7.6 High
- plist project plistPrototype pollution in Plist before 3.0.5 can cause denial of service9.8 Critical
- appwrite, litespeed.js project litespeed.js +1 morePrototype Pollution7.3 High
- patriksimek vm2Sandbox Bypass9.8 Critical
- fastify fastify-multipartDenial of Service (DoS)7.5 High
- blitz-js superjson, blitzjs blitz +1 morePrototype Pollution leading to Remote Code Execution in superjson9.1 Critical
- frourioValidation bypass in frourio8.1 High
- frourio frourio-expressValidation bypass in frourio-express8.1 High
- skratchdot object-path-setPrototype Pollution7.5 High
- putil-merge project putil-mergePrototype Pollution8.2 High
- set project setPrototype Pollution7.5 High
- joinmastodon mastodon, mastodon mastodon/mastodon +1 morePrototype Pollution in mastodon/mastodon7.4 High
- bmoor project bmoorPrototype Pollution7.3 High
- keyget project keygetPrototype Pollution5.6 Medium
- cached-path-relative project cached-path-relative, debian linux +1 morePrototype Pollution7.3 High
- camunda min-dashPrototype Pollution7.5 High
- nodejs node, node.js, debian linux +9 more +11 moreDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 High
- digitalbazaar forgenode-forge ASN.1 OID Integer Truncation6.3 Medium
- digitalbazaar forgeImproper Verification of Cryptographic Signature in `node-forge`5.3 Medium
- agoric realms-shimSandbox Bypass9.8 Critical
- eggjs extend2Prototype Pollution7.3 High
- agoric realms-shimSandbox Bypass9.8 Critical
- digitalbazaar digitalbazaar/forge, forge +1 moreOpen Redirect in digitalbazaar/forge5.3 Medium
- oroinc oroplatform, platform +1 moreJavaScript Prototype Pollution in oro/platform8.8 High
- js-dataPrototype Pollution7.5 High
- linuxfoundation dojo, debian linux, oracle communications policy management +2 more +4 morePrototype Pollution7.5 High
- sey project seyPrototype Pollution6.5 Medium
- merge-deep2 project merge-deep2Prototype Pollution6.5 Medium
- c2fo combPrototype Pollution6.5 Medium
- fabiocaccamo fabiocaccamo/utils.js, utils.js project utils.js +1 morePrototype Pollution in fabiocaccamo/utils.js8.0 High
- nodebbXSS via prototype pollution9.0 Critical
- algolia algoliasearch-helperPrototype Pollution5.9 Medium
- json-schema project json-schema, kriszyp kriszyp/json-schema, debian linux +2 morePrototype Pollution in kriszyp/json-schema9.8 Critical
- json-ptr project json-ptrPrototype Pollution5.6 Medium
- janl jsonpointerPrototype Pollution5.6 Medium
- dotty project dottyPrototype Pollution5.6 Medium
- manuelstofer json-pointerPrototype Pollution5.6 Medium
- binaryops x-assignPrototype Pollution8.6 High
- patriksimek vm2Sandbox Bypass9.8 Critical
- config-handler project config-handlerPrototype Pollution6.5 Medium
- aurelia path, bluespire aurelia-path +1 morePrototype pollution in aurelia-path9.1 Critical
- Show moreLoading…