CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
convictnpmConvict has prototype pollution via load(), loadFile(), and schema initialization9.4 Critical- jonschlinkert picomatchPicomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching5.3 Medium
- n8nn8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCE9.4 Critical
- qwikQwik has array method pollution in FormData processing, allowing type confusion and DoS7.5 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Prototype Pollution via parse()8.9 High
- parse-community parse-serverParse Server vulnerable to schema poisoning via prototype pollution in deep copy5.3 Medium
- parse-community parse-serverParse Server's Cloud function dispatch crashes server via prototype chain traversal8.2 High
- elysiajs elysiaElysia Cookie Value Prototype Pollution6.5 Medium
- lagom whmcs templateLagom WHMCS Template Datatables prototype pollution5.1 Medium
- @apollo gateway, federation-internals, query-planner +2 moreApollo Federation has prototype pollution via incomplete key sanitization9.9 Critical
- svelte devaluedevalue has prototype pollution in devalue.parse and devalue.unflatten6.3 Medium
- honoHono - Prototype Pollution via __proto__ Key in parseBody with dot Option6.3 Medium
- parse-community parse-serverParse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution8.8 High
- rustdesk, rustdesk-client rustdesk client +1 moreRustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)8.2 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable8.7 High
- openclawOpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Path2.3 Low
- middleapi orpcoRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization9.3 Critical
- dottie project dottie, mickhansen dottie.js +1 moreDottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()6.3 Medium
- higuma web-audio-recorder-js, webaudiorecorder.js +1 morehiguma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution2.3 Low
- sveltejs devalueSvelte devalue: DoS via malformed input5.3 Medium
- nolimits4web swiperSwiper has a Prototype Pollution Vulnerability9.4 Critical
- No product listedA State Pollution vulnerability was discovered in the TON Virtual Machine (TVM) before v2025.04....7.5 High
- ahdinosaur set-inPrototype pollution in set-in9.4 Critical
- casl ability abilityCASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.9.8 Critical
- nyariv sandboxjs@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)9.1 Critical
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios affected by Denial of Service via __proto__ Key in mergeConfig7.5 High
- adonisjs bodyparser, core +1 moreAdonisJS multipart body parsing has Prototype Pollution issue7.2 High
- qwikPrototype Pollution via FormData Processing in Qwik City9.3 Critical
- locutus, red hat logging subsystem for red hat openshift +1 moreLocutus is vulnerable to Prototype Pollution9.4 Critical
- nyariv sandboxjsSandboxJS Prototype Pollution -> Sandbox Escape -> RCE10.0 Critical
- sharpred deephasdeepHas vulnerable to Prototype Pollution via constructor.prototype9.4 Critical
- microsoft maker.jsMaker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject6.5 Medium
- nocodbNocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS4.9 Medium
- dchester jsonpath, red hat migration toolkit for virtualization, openshift pipelines +11 more +13 moreJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js9.8 Critical
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functions6.9 Medium
- lxsmnsyc serovalseroval Affected by Prototype Pollution via JSON Deserialization7.3 High
- tarkov data manager, the-hideout tarkov-data-manager +1 moreTarkov Data Manager Authentication Bypass vulnerability9.8 Critical
- carboneio carbonecarboneio carbone Formatter input.js prototype pollution2.3 Low
- apidoc apidoc-coreapidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker9.3 Critical
- trpctRPC has possible prototype pollution in `experimental_nextAppDirCaller`8.5 High
vuetifynpm,@rootio/vuetifyRoot +1 moreVuetify Prototype Pollution via Preset options8.6 High- elysiajs elysiaElysia vulnerable to prototype pollution with multiple standalone schema validation9.1 Critical
- silentmatt expr-eval, javascript expression evaluator +1 moreCVE-2025-132049.8 Critical
- rollbar rollbar.jsRollbar.js Prototype Pollution Vulnerability in merge()5.9 Medium
- capricorn86 happy-dom--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom9.4 Critical
- ciscoheat sveltekit-superformssveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`8.3 High
- parse-community parse-sdk-jsParse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs6.4 Medium
- algolia algoliasearch-helperalgoliasearch-helper is vulnerable to Prototype Pollution in _merge()7.5 High
drefnpmdref is vulnerable to prototype pollution7.5 Highcounterpartnpmcounterpart vulnerable to prototype pollution6.5 Medium- Show moreLoading…