CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- tree kit project kittree-kit Prototype Pollution vulnerability9.8 Critical
- hello.js project hello.jsMrSwitch hello.js vulnerable to prototype pollution9.8 Critical
- underscore-keypath project underscore-keypathunderscore-keypath vulnerable to Prototype Pollution7.5 High
- supsystic popup, popup by supsystic +1 moreSupsystic Popup < 1.10.19 - Prototype Pollution9.8 Critical
- automattic automattic/mongoose, mongoosejs mongoose +1 morePrototype Pollution in automattic/mongoose10.0 Critical
- protobufjs project protobufjsprotobufjs Prototype Pollution vulnerability9.8 Critical
- salesforce tough-cookietough-cookie Prototype Pollution vulnerability6.5 Medium
- flatnest project flatnestflatnest Prototype Pollution vulnerability7.3 High
- parse-community parse-serverParse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution9.8 Critical
- progressbar.js project progressbar.jsprogressbar.js vulnerable to Prototype Pollution8.2 High
- dottie project dottiedottie vulnerable to Prototype Pollution7.5 High
- antfu antfu/utils, utils +1 morePrototype Pollution in antfu/utils5.4 Medium
- aiven, aiven aiven-extras +1 moreaiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path8.8 High
- strikinglyA prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross...6.1 Medium
- aedart ion@aedart/support possibly vulnerable to prototype pollution in metadata record, when using meta decorator3.7 Low
- tencent vconsolePrototype Pollution in vConsole9.8 Critical
- sheetjsPrototype Pollution in sheetJS7.8 High
- safe-eval project safe-evalsafe-eval vulnerable to Sandbox Bypass due to improper input sanitization8.8 High
- safe-eval project safe-evalsafe-eval vulnerable to Prototype Pollution via the safeEval function7.5 High
- xml2js project xml2jsxml2js 0.4.23 - Prototype Pollution5.3 Medium
- matrix-org matrix-react-sdkPrototype pollution in matrix-react-sdk8.2 High
- matrix-org matrix-js-sdk, matrix javascript sdk +1 morePrototype pollution in matrix-js-sdk8.2 High
- matrix-org matrix-react-sdk, matrix react sdk +1 morePrototype pollution in matrix-react-sdk8.2 High
- collection.js project collection.jsCollection.js vulnerable to Prototype Pollution7.5 High
- dot-lens project dot-lensdot-lens vulnerable to Prototype Pollution7.5 High
- utilities project utilitiesmde utilities contains Prototype Pollution7.5 High
- rangy project rangyrangy vulnerable to Prototype Pollution7.5 High
- rocket.chatA prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an...8.8 High
- visio globe visiowebVisioweb.js - Prototype Pollution can results in XSS7.2 High
- mozilla convictPrototype Pollution in convict8.4 High
- baobab project baobabYomguithereal Baobab prototype pollution6.3 Medium
- json-pointer project json-pointerjson-pointer index.js set prototype pollution6.3 Medium
- starcounter-jack json-patchStarcounter-Jack JSON-Patch prototype pollution6.3 Medium
- flat project flathughsk flat index.js unflatten prototype pollution6.3 Medium
- cronvel tree-kit, tree kit project kit +1 morecronvel tree-kit prototype pollution5.5 Medium
- json5, fedoraproject fedora +1 morePrototype Pollution in JSON5 via Parse Method7.1 High
- linkedin dustjsLinkedIn dustjs prototype pollution6.3 Medium
- safe-eval project safe-evalPrototype Pollution7.5 High
- furqan node-whois, furqansofware node whois +1 moreFurqan node-whois index.coffee prototype pollution6.3 Medium
- chbrown rfc6902chbrown rfc6902 pointer.ts prototype pollution5.5 Medium
- openjsf express, qs project qs, debian linux +2 moreqs vulnerable to Prototype Pollution7.5 High
- parse-community parse-serverParse Server subject to Prototype pollution via Cloud Code Webhooks7.2 High
- parse-community parse-serverParse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers7.2 High
- parse-community parse-serverParse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser9.8 Critical
- deep-parse-json project deep-parse-jsondeep-parse-json 1.0.2 - Prototype Pollution5.3 Medium
- fastest-json-copy project fastest-json-copyfastest-json-copy 1.0.1 - Prototype Pollution5.3 Medium
- deep-object-diff project deep-object-diffdeep-object-diff 1.1.0 - Prototype Pollution5.3 Medium
- browserify-shim project browserify-shimthlorenz browserify-shim vulnerable to prototype pollution9.8 Critical
- browserify-shim project browserify-shimthlorenz browserify-shim vulnerable to prototype pollution9.8 Critical
- wintercms winterWinter vulnerable to Prototype Pollution in Snowboard framework8.1 High
- Show moreLoading…