CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- js-cookie javascript cookie, js-cookie, red hat cryostat 4 on rhel 9 +24 more +26 moreJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection7.5 High
- hcl software compassPrototype pollution in csv parsing5.3 Medium
- ecies goGestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath8.2 High
- milamer parse-nested-form-dataPrototype Pollution in parse-nested-form-data via `__proto__` in FormData field names8.2 High
- kaspernj form-data-objectizerPrototype pollution in form-data-objectizer via bracket-notation form keys8.2 High
jsondiffpatchnpm,@rootio/jsondiffpatchRoot +1 morejsondiffpatch patch APIs are vulnerable to prototype pollution8.8 High- ranfdev deepobjdeepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')8.2 High
- n8nn8n: XML Node Prototype Pollution Patch Bypass9.4 Critical
- n8nn8n: HTTP Request Node Pagination Prototype Pollution to RCE9.4 Critical
- protobufjs project protobufjs, protobufjs protobuf.js +1 moreprotobufjs: Prototype injection in generated message constructors5.3 Medium
- protobufjs project protobufjs, protobufjs protobuf.js +1 moreprotobufjs: Code generation gadget after prototype pollution8.1 High
- protobufjs project protobufjs, protobufjs protobuf.js +1 moreprotobufjs: Process-wide denial of service through unsafe option paths7.5 High
- multipartymultiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception7.5 High
@theecryptochad/merge-guardnpm@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function7.5 High- @rvf set-get, airjp73 rvf +1 moreRVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)8.2 High
- shepherdwind velocity.jsVelocity.js: Prototype Pollution in #set path assignment8.3 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox escape10.0 Critical
query-string-parsernpmquery-parser-string is vulnerable to Prototype Pollution9.8 Criticalparse-ininpmparse-ini is vulnerable to Prototype Pollution in index.js()9.8 Criticalnext-intlnpmnext-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys4.2 Mediumicu-minifynpmmcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`3.7 Low- axios, red hat cryostat 4, gatekeeper 3 +45 more +47 moreAxios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking7.4 High
- n8nn8n: XML Node Prototype Pollution to RCE9.4 Critical
- n8nn8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE9.4 Critical
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy4.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +59 more +61 moreAxios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`6.5 Medium
- axiosAxios: Header Injection via Prototype Pollution7.4 High
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking7.4 High
- evomap evolverEvolver: Prototype Pollution via `Object.assign()` in mailbox store operations5.2 Medium
- i18next i18next-http-middlewarePrototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters8.6 High
- 1024bit extend-deep1024bit extend-deep index.js prototype pollution6.9 Medium
- brikcss mergebrikcss merge prototype pollution6.9 Medium
- mafintosh protocol-buffers-schema parserMafintosh's protocol-buffers-schema is vulnerable to prototype pollution6.5 Medium
- adobe acrobat, acrobat 2024, acrobat dc +1 more +3 moreAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)8.6 High
- adobe acrobat, acrobat 2024, acrobat dc +1 more +3 moreAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)6.3 Medium
- adobe acrobat, acrobat 2024, acrobat and reader +2 more +4 moreAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)8.6 High
- langchain langsmith, langchain-ai langsmith-sdk +1 moreLangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`5.6 Medium
- unjs defudefu: Prototype pollution via `__proto__` key in defaults argument7.5 High
- stablelibStableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding8.9 High
- lodash, lodash lodash-amd, lodash-es +2 more +4 morelodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`6.5 Medium
- mikro-orm mikroorm, mikro-orm +1 moreMikroORM has Prototype Pollution in Utils.merge8.3 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +11 more +13 moreHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options8.3 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation7.5 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion9.8 Critical
- locutusLocutus Prototype Pollution due to incomplete fix for CVE-2026-255216.3 Medium
- locutusLocutus has Prototype Pollution via __proto__ Key Injection in unserialize()6.9 Medium
- handlebars-lang handlebars.js, handlebarsjs handlebars +1 moreHandlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection4.7 Medium
convictnpmConvict has Prototype Pollution via startsWith() function9.4 Critical- Show moreLoading…