Weakness (CWE)
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
How to prevent it (5 mitigations)
-
Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
-
Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
-
Implementation
When handling untrusted objects, validating using a schema can be used.
-
Implementation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
-
Implementation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Source: MITRE CWE-1321
172 results · Clear filters · Feed
-
Critical 9.8
Prototype Pollution
The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.
-
Critical 9.8
Prototype Pollution
The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
-
Critical 9.8
Prototype Pollution
All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.
-
Critical 9.8
Prototype Pollution
All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.
-
Critical 9.8
Prototype Pollution
madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
-
Critical 9.8
Prototype Pollution
All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
-
Critical 9.8CVE-2019-19919 Public exploit
Prototype Pollution in handlebars
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payl…
-
Critical 9.8
Prototype Pollution in set-value
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.
-
Critical 9.8
Deserialization of untrusted data in FasterXML jackson-databind
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
-
Critical 9.1CVE-2019-10744 Public exploit
Prototype Pollution in lodash
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
-
Critical 9.8
Prototype Pollution in just-extend
A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.
-
Critical 9.8
Prototype Pollution in async merge-object
The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing…