Weakness (CWE)
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
How to prevent it (5 mitigations)
-
Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
-
Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
-
Implementation
When handling untrusted objects, validating using a schema can be used.
-
Implementation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
-
Implementation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Source: MITRE CWE-1321
712 results · Feed
-
High 7.2
Parse Server subject to Prototype pollution via Cloud Code Webhooks
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypas…
-
Medium 5.3
deep-object-diff 1.1.0 - Prototype Pollution
deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the '__proto__' property to be edited.
-
Medium 5.3
fastest-json-copy 1.0.1 - Prototype Pollution
fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
-
Medium 5.3
deep-parse-json 1.0.2 - Prototype Pollution
deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
-
Critical 9.8
thlorenz browserify-shim vulnerable to prototype pollution
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.
-
Critical 9.8
thlorenz browserify-shim vulnerable to prototype pollution
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.
-
High 8.1
Winter vulnerable to Prototype Pollution in Snowboard framework
Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 bran…
-
Critical 10.0
Feathers - Query “__proto__” is converted to real prototype
Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.
-
Critical 9.8
Grunt-karma vulnerable to prototype pollution
Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.
-
Critical 9.8
tschaub gh-pages vulnerable to prototype pollution
Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.
-
Critical 9.8
Prototype pollution in webpack loader-utils
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
-
Critical 9.8
mockery is vulnerable to prototype pollution
Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js.
-
Critical 9.8
thlorenz browserify-shim vulnerable to prototype pollution
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.
-
High 7.3
Prototype Pollution
The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
-
High 8.1
hoek subject to prototype pollution via the clone function.
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
-
Critical 9.8
steal vulnerable to Prototype Pollution via alias variable
Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.
-
Critical 9.8
steal vulnerable to Prototype Pollution
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.
-
Critical 9.8
steal vulnerable to Prototype Pollution via optionName variable
Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.
-
Critical 9.8
steal vulnerable to Prototype Pollution via requestedVersion variable
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.
-
Critical 9.8
steal vulnerable to Prototype Pollution via key variable in babel.js
Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.
-
High 7.5
Prototype Pollution
The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.
-
High 7.0CVE-2022-2564 EPSS 31%
Prototype Pollution in automattic/mongoose
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
-
High 7.5
Prototype Pollution
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.
-
High 7.3
Prototype Pollution
This affects the package properties-reader before 2.2.0.
-
Medium 5.6
Prototype Pollution
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.
-
High 7.3
Prototype Pollution
This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
-
High 7.3
Prototype Pollution
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
-
High 7.3
Prototype Pollution
This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.
-
Medium 4.0
Prototype Pollution
This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
-
Critical 9.8
Prototype Pollution in deep.assign
deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
-
High 8.3
Prototype Pollution in underscore.deep
Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to `deepFrom…
-
High 7.5
Prototype Pollution
All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7715](https://security.snyk.io/vuln/SNYK-JS-DEEPGETSET-598666)
-
Medium 5.9
Prototype Pollution
All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-760…
-
High 7.5
Prototype Pollution
This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used t…
-
High 8.2
Prototype Pollution
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or…
-
Medium 4.0
Prototype Pollution
This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-7618](…
-
High 7.5
Prototype Pollution
This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies o…
-
High 7.7
Prototype Pollution
All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype.
-
High 7.5
Prototype Pollution
The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-J…
-
Medium 6.5
Prototype Pollution
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it …