CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
@messageformat/runtimenpmmessageformat prototype pollution vulnerability5.3 Mediummin-documentnpm,node-min-documentDebian +1 moremin-document vulnerable to prototype pollution5.3 Mediumts-fnsnpmts-fns has prototype pollution vulnerability6.5 Medium- keyangxiang csvtojsonCSVTOJSON has a prototype pollution vulnerability8.6 High
- openjsf messageformatmessageformat has a prototype pollution vulnerability7.5 High
- node-cubenode-cube vulnerable to prototype pollution6.5 Medium
- tbo47 dagre-d3-esA vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within...9.8 Critical
- web3js web3-core-subscriptionsweb3-core-subscriptions has a Prototype Pollution vulnerability7.5 High
- web3js web3-core-methodweb3-core-method is vulnerable to prototype pollution7.5 High
- jonschlinkert toggle-arraytoggle-array vulnerable to prototype pollution7.5 High
- spmjs spmrcspmrc vulnerable to prototype pollution7.5 High
- sassdoc sassdoc-extrassassdoc-extras vulnerable to prototype pollution7.5 High
- rollbarDuplicate Advisory: rollbar vulnerable to prototype pollution7.5 High
- parseplatform parse javascript sdkparse is vulnerable to prototype pollution6.5 Medium
- regularjs mpregularmpregular vulnerable to prototype pollution7.5 High
- magix-combine-ex project magix-combine-exmagix-combine-ex vulnerable to prototype pollution9.8 Critical
- open-federation json-schema-editor-visualjson-schema-editor-visual vulnerable to prototype pollution6.5 Medium
fast-redactTuxCareWithdrawn Advisory: fast-redact vulnerable to prototype pollution7.5 High- pradeep-mishra csvjsoncsvjson vulnerable to prototype injection7.5 High
- huawei harmonyosVulnerability of exposing object heap addresses in the Ark eTS module. Impact: Successful...8.4 High
- sveltejs devalueSvelte devalue vulnerable to prototype pollution7.9 High
- denoland std@std/toml Prototype Pollution in Node.js and Browser7.3 High
- spreecommerce spree, spreecommerce +1 moreSpreecommerce < 0.60.2 Search Parameter RCE10.0 Critical
- helmetjs content-security-policy-parsercontent-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE8.8 High
- sunnyadn js-tomljs-toml is vulnerable to Prototype Pollution7.9 High
- nyariv sandboxjsnyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS7.0 High
- linkifyLinkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)8.8 High
- pdfmepdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluation6.1 Medium
- No product listedAn issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, proto, and Object.assign components. NOTE: this is disputed by the Supplier who do…5.7 Medium
- naver billboard.jsbillboard.js allows prototype pollution via the function generate9.8 Critical
- radashi-org radashiRadashi Vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')6.8 Medium
- linuxfoundation docarraydocarray Web API torch_dataset.py __getitem__ prototype pollution5.3 Medium
- citeum openctiOpenCTI vulnerable to Denial of Service through web hook7.6 High
- elastic kibanaKibana arbitrary code execution via prototype pollution9.1 Critical
- nortikin sverchoknortikin Sverchok Set Property Mk2 Node getsetprop_mk2.py SvSetPropNodeMK2 prototype pollution5.3 Medium
- elastic kibanaKibana Prototype Pollution can lead to code injection8.7 High
js-object-utilitiesnpmjs-object-utilities Vulnerable to Prototype Pollution7.0 High- remcohaszing estree-util-value-to-estreeestree-util-value-to-estree allows prototype pollution in generated ESTree6.9 Medium
- amauric tarteaucitron.js, amauri tarteaucitronjs +1 moretarteaucitron.js allows prototype pollution via custom text injection5.5 Medium
expand-objectnpmexpand-object Vulnerable to Prototype Pollution via the expand() Function6.9 Medium- redocly redocRedoc Prototype Pollution via `Module.mergeObjects` Component7.5 High
- alizeait unflattoDuplicate Advisory: @alizeait/unflatto Prototype Pollution via `exports.unflatto` Method9.8 Critical
- janrywang depathdepath and cool-path vulnerable to Prototype Pollution via `set()` Method9.8 Critical
- aliconnect software development kitA Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary...9.8 Critical
- jonschlinkert parse-git-configPrototype Pollution Vulnerability in parse-git-config7.5 High
- canvgcanvg Prototype Pollution vulnerability9.8 Critical
- intlify vue-i18nVue I18n Prototype Pollution in `handleFlatJson`8.9 High
- elastic kibanaKibana arbitrary code execution via prototype pollution9.9 Critical
- progress kendo ui for vue, progress software progress® telerik® kendo ui for vue +1 morePrototype Pollution in Progress® Telerik® Kendo UI for Vue4.1 Medium
- progress kendoreact, progress software telerik kendoreact +1 morePrototype Pollution in Progress® Telerik® KendoReact4.1 Medium
- Show moreLoading…