CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- automattic mongooseMongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)6.5 Medium
- svelte sveltekit, sveltejs kit +1 moreSvelteKit before 2.69.1 Prototype Pollution via File Input5.3 Medium
- delvedor find-my-wayfind-my-way is Vulnerable to DDoS with HTTP27.5 High
- n8nn8n before 1.123.67 Prototype Pollution via VM Expression Engine6.1 Medium
- n8nn8n before 1.123.67 Prototype Pollution via Edit Fields7.1 High
- No product listedVersions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the...6.3 Medium
- axiosaxios before 0.33.0 Prototype Pollution via Node HTTP adapter8.3 High
- axiosaxios before 0.33.0 Prototype Pollution via nested option objects6.3 Medium
- axiosaxios before 1.18.0 Prototype Pollution via bodyless methods6.3 Medium
- freescout-help-desk freescoutFreeScout vulnerable to prototype pollution in getQueryParam4.6 Medium
- axiosaxios before 1.18.0 Prototype Pollution via auth subfields6.3 Medium
- cartodb carto-api-clientCartoDB carto-api-client filters.ts addFilter prototype pollution5.3 Medium
- robinherbots inputmaskRobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution5.3 Medium
- sagold json-schema-librarysagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution5.3 Medium
- feathersjs feathersFeathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__3.7 Low
- No product listedtamagui config.ts updateConfig prototype pollution5.3 Medium
- spencermountain compromisespencermountain compromise Public Root API extend.js nlp.extend prototype pollution5.3 Medium
- kofrasa mingokofrasa mingo Update API updateMany prototype pollution5.3 Medium
- svgdotjs svg.jssvgdotjs svg.js npm Package API EventTarget.on prototype pollution5.3 Medium
- clickhouse dbtanstack db Alias Path select.ts select prototype pollution5.3 Medium
- antv layoutantv layout object.js setNestedValue prototype pollution5.3 Medium
- primefaces primereactprimefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution5.3 Medium
- apidevtools json-schema-ref-parserapidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution5.3 Medium
- n8nn8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration7.1 High
- protobufjs project protobufjs, protobufjs protobuf.js +1 moreprotobufjs: Text Format string map parsing can mutate returned map object prototype4.8 Medium
- gchq cyberchefCyberChef: Prototype pollution in Series Chart operation5.0 Medium
- No product listedenquirer Public Package API Enquirer.set prototype pollution5.3 Medium
- hey-api openapi-tsHey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key4.8 Medium
- xdan joditJodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge6.3 Medium
- adonisjs coreIncomplete fix for CVE-2026-25754 in @adonisjs/bodyparser8.6 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype...2.6 Low
- style-dictionaryStyle Dictionary - Prototype Pollution in convertTokenData utility function8.8 High
- thomaspoignant scim-patchscimPatch vulnerable to prototype pollution via unfiltered keys in patch9.1 Critical
- joaonuno flat-to-nested-jsflat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key7.5 High
- deepstreamio deepstream.iodeepstream is vulnerable to prototype pollution9.9 Critical
- piscinajs piscinapiscina: Prototype Pollution Gadget → RCE via inherited options.filename8.1 High
- xdan joditJodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()6.3 Medium
- thingsboardThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code...8.6 High
- n8nn8n: Microsoft SQL Node Prototype Pollution7.2 High
- n8nn8n: Prototype Pollution enables confused-deputy execution via public webhooks6.3 Medium
- i18next i18next-http-middlewarei18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names9.1 Critical
- i18next i18next-fs-backendi18next-fs-backend: Prototype pollution via crafted missing-key string9.1 Critical
- rubylouvre avalonRubyLouvre avalon Template Filter index.js prototype pollution6.9 Medium
- jsonata-js jsonatajsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution6.9 Medium
- apostrophecms apostropheApostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass9.1 Critical
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge7.0 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`8.7 High
- axiosAxios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions4.8 Medium
- axiosAxios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix3.7 Low
- nevware21 ts-utils@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty7.2 High
- Show moreLoading…