CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
node-opcua-alarm-conditionnpmnode-opcua-alarm-condition prototype pollution vulnerability7.5 High@stryker-mutator/utilnpm@stryker-mutator/util vulnerable to Prototype Pollution7.5 High- No product listedA prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to...7.5 High
@rpldy/uploadernpm@rpldy/uploader prototype pollution6.5 Medium- No product listedA prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers...7.5 High
vxe-tablenpmvxe-table prototype pollution7.5 High@zag-js/corenpm@zag-js/core prototype pollution7.5 High- No product listedA prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a...7.5 High
utils-extendnpmutils-extend Prototype Pollution9.1 Critical- No product listedA prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a...7.5 High
eazy-loggernpmeazy-logger prototype pollution7.5 High- No product listedA prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a...7.5 High
module-from-stringnpmmodule-from-string prototype pollution7.5 High- No product listedA prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause...7.5 High
- No product listedA prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a...7.5 High
- No product listedA prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a...7.5 High
@ndhoule/defaultsnpm@ndhoule/defaults prototype pollution7.5 High- No product listedA prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a...7.5 High
- No product listedA prototype pollution in the lib.setValue function of @syncfusion/ej2-spreadsheet v27.2.2 allows...7.5 High
- No product listedA prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause...7.5 High
jsiinpmPrototype pollution in jsii.configureCategories3.7 Low- farinspace partnersWordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability9.8 Critical
- bunBun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo7.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype...4.2 Medium
- intlify vue-i18nPrototype Pollution in @intlify/shared >=9.7.0 <= 10.0.46.9 Medium
- rajesh thanoch quick learnWordPress Quick Learn plugin <= 1.0.1 - PHP Object Injection vulnerability9.8 Critical
- cure53 dompurifyDOMPurify vulnerable to tampering by prototype polution9.1 Critical
mermaidnpmPrototype pollution vulnerability found in Mermaid's bundled version of DOMPurify7.0 High- sap se hana client, sap hana-client +1 morePrototype Pollution vulnerability in SAP HANA Client4.3 Medium
@saltcorn/servernpm@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings7.3 High- leeoniya uplotuPlot Prototype Pollution vulnerability8.8 High
- backstagePrototype pollution in @backstage/plugin-catalog-backend6.5 Medium
- dset project dsetdset Prototype Pollution vulnerability8.8 High
node-gettextnpmnode-gettext vulnerable to Prototype Pollution5.9 Medium- chartistChartist 1.x through 1.3.0 allows Prototype Pollution via the extend function.9.8 Critical
- elastic kibanaKibana arbitrary code execution via prototype pollution9.1 Critical
- izatop buntPrototype pollution in izatop bunt9.8 Critical
- ais strategyenais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function...9.8 Critical
- redocly redoc, chargeover chargeover\/redoc +1 morePrototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code...9.8 Critical
- chasemoskal snapstatechase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function...9.8 Critical
- 75lb deep-merge@75lb/deep-merge Prototype Pollution vulnerability9.8 Critical
- lukebond json-overridePrototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code...9.8 Critical
- alykoshin mini-deep-assignPrototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary...9.8 Critical
- allpro form-manager, formmanager data handler +1 morePrototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause...9.8 Critical
- hewlett packard enterprise (hpe) hpe aruba networking edgeconnect sd-wan, arubanetworks edgeconnect sd-wan orchestrator +1 moreAuthenticated Server-Side prototype pollution Leading to Information Disclosure7.2 High
- arubanetworks edgeconnect sd-wan orchestrator, hewlett packard enterprise hpe aruba networking edgeconnect sd-wan orchestrator +1 moreA vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could...7.2 High
- adolphdudu ratio-swiper, swiperjs swiper +1 moreadolph_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the function...6.5 Medium
- harvey-woo key-serializer@cat5th/key-serializer Prototype Pollution vulnerability6.3 Medium
- che3vinci utilsche3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function...8.1 High
- cahilfoley utilsahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set...9.8 Critical
- Show moreLoading…