CWE-1321: Prototype Pollution
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Also known as Improperly Controlled Modification of Object Prototype Attributes.
A kind of CWE-915 Mass Assignment.
From the CWE List. © The MITRE Corporation.
Newest
- @socket.io cluster-engine, socketio socket.io +1 moreSocket.IO: Prototype Pollution via Unsafe Client Session Lookup7.5 High
- axiosAxios: Prototype Pollution Gadget in axios toFormData Options8.3 High
- axiosAxios: Prototype pollution gadget in fetch adapter can alter outbound requests6.9 Medium
- axiosAxios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection7.6 High
- axiosAxios: Header Injection via Inherited headers After Minimal Interceptor6.9 Medium
- axiosAxios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method6.9 Medium
- axiosAxios: Fetch Adapter Header Injection via Inherited FormData getHeaders6.9 Medium
- swmansion react native reanimatedA prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2...5.3 Medium
- mwilliamson mammoth.jsmammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the...8.4 High
- thomaspoignant scim-patchscim-patch: Mutation of Inherited Built-in Method Objects4.3 Medium
- sveltejs devaluedevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers7.5 High
- patriksimek vm2vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray9.3 Critical
- builderio @builder.io/sdk-angular, @builder.io/sdk-qwik, @builder.io/sdk-react +4 more +6 moreBuilder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes5.3 Medium
- builderio @builder.io/sdk-angular, @builder.io/sdk-qwik, @builder.io/sdk-react +4 more +6 moreBuilder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings7.2 High
- node-opcuanode-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)3.7 Low
- hapijs joijoi before 17.13.8 and 18.2.9 Prototype Pollution via messages6.3 Medium
- confetti yaysonYayson: Prototype pollution in the Store/LegacyStore deserialization9.1 Critical
- isomorphic-gitisomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo7.1 High
- n8nn8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service6.0 Medium
- adobe acrobat, acrobat reader, acrobat 2024 +2 more +4 moreAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)8.2 High
- crcn sift.jssift 17.1.3 Prototype Pollution Remote Code Execution via $where9.2 Critical
- binarymuse toml-nodetoml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization8.2 High
- adaltas node-csvnode-csv: Prototype replacement still reachable via columns path6.9 Medium
- toon-format toonTOON: Prototype pollution when decoding untrusted TOON input8.3 High
@tiptap/corenpmTiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes6.4 Medium- hapijs joiJoi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key6.3 Medium
- hapijs joijoi: Prototype pollution via a `__proto__` language key in custom messages3.7 Low
- hapijs joijoi: object().rename() with a template target can set the validated object's prototype3.7 Low
- livewireLivewire DOM-based cross-site scripting during client-side state handling5.1 Medium
- cleverbrush deep, framework +1 morecleverbrush framework/deep deepExtend.ts deepExtend prototype pollution6.9 Medium
- ractivejs ractiveractivejs ractive Keypath Ractive#set prototype pollution6.9 Medium
- alibaba-fusion nextalibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution6.9 Medium
- rexrainbow phaser3-rex-notesrexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution5.3 Medium
- No product listedjQWidgets jqx-all.js jqxBaseFramework.extend prototype pollution6.9 Medium
- exceljsexceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization9.3 Critical
- opensearch dashboards, aws amazon opensearch service +1 moreRCE via Prototype Pollution in OpenSearch Dashboards8.7 High
- locize gettext-convertergettext-converter: Prototype pollution in js2i18next() via crafted translation keys8.3 High
- n8nn8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution6.0 Medium
- zabbixPrototype pollution leading to stored XSS8.5 High
- apostrophecms apostropheApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS7.1 High
- triggerdotdev trigger.devTrigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS8.5 High
- browserslistBrowserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)7.5 High
- mermaid-js mermaidMermaid configuration APIs allow prototype pollution2.4 Low
- mermaid-js mermaidMermaid Architecture diagrams are vulnerable to prototype pollution6.5 Medium
- electronElectron: contextBridge object copy honors prototype setters5.4 Medium
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge`...5.7 Medium
- hackerone defaults-deep@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging7.3 High
- ibm observability with instana (agent)IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image7.3 High
- pivotickPivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service5.1 Medium
- quasarframework quasarQuasar Framework: Prototype pollution in Quasar extend() utility5.6 Medium
- Show moreLoading…