Weakness (CWE)
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
How to prevent it (5 mitigations)
-
Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
-
Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
-
Implementation
When handling untrusted objects, validating using a schema can be used.
-
Implementation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
-
Implementation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Source: MITRE CWE-1321
172 results · Clear filters · Feed
-
Critical 10.0
Prototype Pollution in automattic/mongoose
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
-
Critical 9.8
protobufjs Prototype Pollution vulnerability
"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and o…
-
Critical 9.8
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A pat…
-
Critical 9.8
Prototype Pollution in vConsole
vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.
-
Critical 9.8CVE-2022-39396 EPSS 39%
Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. An attacker can use this …
-
Critical 9.8
thlorenz browserify-shim vulnerable to prototype pollution
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.
-
Critical 9.8
thlorenz browserify-shim vulnerable to prototype pollution
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.
-
Critical 10.0
Feathers - Query “__proto__” is converted to real prototype
Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.
-
Critical 9.8
Grunt-karma vulnerable to prototype pollution
Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.
-
Critical 9.8
tschaub gh-pages vulnerable to prototype pollution
Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.
-
Critical 9.8
Prototype pollution in webpack loader-utils
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
-
Critical 9.8
mockery is vulnerable to prototype pollution
Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js.
-
Critical 9.8
thlorenz browserify-shim vulnerable to prototype pollution
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.
-
Critical 9.8
steal vulnerable to Prototype Pollution via alias variable
Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.
-
Critical 9.8
steal vulnerable to Prototype Pollution
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.
-
Critical 9.8
steal vulnerable to Prototype Pollution via optionName variable
Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.
-
Critical 9.8
steal vulnerable to Prototype Pollution via requestedVersion variable
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.
-
Critical 9.8
steal vulnerable to Prototype Pollution via key variable in babel.js
Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.
-
Critical 9.8
Prototype Pollution in deep.assign
deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
-
Critical 9.8
Prototype Pollution in simple-plist
Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().
-
Critical 9.8CVE-2021-44906 Public exploit
Prototype Pollution in minimist
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
-
Critical 9.8
Prototype Pollution in Sails.js
SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().
-
Critical 10.0
Command Injection in Parse server
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that…
-
Critical 9.8
Prototype pollution in Plist before 3.0.5 can cause denial of service
Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
-
Critical 9.8
Sandbox Bypass
The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.
-
Critical 9.1
Prototype Pollution leading to Remote Code Execution in superjson
superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requ…
-
Critical 9.8
Sandbox Bypass
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
-
Critical 9.8
Sandbox Bypass
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
-
Critical 9.0
XSS via prototype pollution
Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account take…
-
Critical 9.8
Prototype Pollution in kriszyp/json-schema
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
Critical 9.8
Sandbox Bypass
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.
-
Critical 9.1CVE-2021-41097 Scanner template
Prototype pollution in aurelia-path
aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to par…
-
Critical 9.8
Prototype Pollution in putil-merge
Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype polluation in just-safe-set
Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
set-getter Prototype Pollution Vulnerability
Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype Pollution
Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in nestie
Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in Merge-deep
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks ag…
-
Critical 9.8
Prototype pollution vulnerability in js-extend
Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in nconf-toml
Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.