Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes

Variant Incomplete

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

How to prevent it (5 mitigations)

  1. Implementation

    By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

  2. Architecture and Design

    By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

  3. Implementation

    When handling untrusted objects, validating using a schema can be used.

  4. Implementation

    By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.

  5. Implementation

    Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

Source: MITRE CWE-1321

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.6
    CVE-2026-34621 Exploited Public exploit

    Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

    Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the curre…

    Adobe Acrobat 2024 Acrobat Reader DC Acrobat DC
    KEV Apr 13, 2026