Weakness (CWE)
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
How to prevent it (5 mitigations)
-
Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
-
Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
-
Implementation
When handling untrusted objects, validating using a schema can be used.
-
Implementation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
-
Implementation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Source: MITRE CWE-1321
712 results · Feed
-
High 7.3
Prototype Pollution
The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This ca…
-
High 7.5
Prototype Pollution
The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://secur…
-
High 7.3
Prototype Pollution
This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototyp…
-
High 7.3
Prototype Pollution in alvarotrigo/fullpage.js
Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.
-
High 7.8
Prototype Pollution in async
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
-
High 8.1
Prototype Pollution in deepmerge-ts
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There ar…
-
Critical 9.8
Prototype Pollution in simple-plist
Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().
-
Critical 9.8CVE-2021-44906 Public exploit
Prototype Pollution in minimist
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
-
Critical 9.8
Prototype Pollution in Sails.js
SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().
-
High 8.6
Prototype Pollution
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/v…
-
High 7.5
Prototype Pollution
The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)
-
Medium 6.5
Sandbox Bypass
This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an ob…
-
Medium 6.3
Prototype Pollution
The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix…
-
Critical 10.0
Command Injection in Parse server
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that…
-
Medium 6.1
Prototype Pollution in jquery.cookie
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
-
High 7.6
Prototype Pollution
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend.
-
Critical 9.8
Prototype pollution in Plist before 3.0.5 can cause denial of service
Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
-
High 7.3
Prototype Pollution
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized …
-
Critical 9.8
Sandbox Bypass
The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.
-
Critical 9.1
Prototype Pollution leading to Remote Code Execution in superjson
superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requ…
-
High 8.1
Validation bypass in frourio
Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for r…
-
High 8.1
Validation bypass in frourio-express
Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Valid…
-
High 7.5
Prototype Pollution
The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK…
-
High 8.2
Prototype Pollution
This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives f…
-
High 7.5
Prototype Pollution
This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOS…
-
High 7.4
Prototype Pollution in mastodon/mastodon
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
-
High 7.3
Prototype Pollution
The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)
-
Medium 5.6
Prototype Pollution
The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix…
-
High 7.3
Prototype Pollution
The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the obj…
-
High 7.5
Prototype Pollution
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
-
Low —
Prototype Pollution in node-forge debug API.
### Impact The `forge.debug` API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist,…
-
Critical 9.8
Sandbox Bypass
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
-
High 7.3
Prototype Pollution
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
-
Critical 9.8
Sandbox Bypass
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
-
High 8.8
JavaScript Prototype Pollution in oro/platform
OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS c…
-
High 7.5
Prototype Pollution
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).
-
High 7.5CVE-2021-23450 EPSS 30%
Prototype Pollution
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
-
Medium 6.5
Prototype Pollution
All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.
-
Medium 6.5
Prototype Pollution
All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.
-
Medium 6.5
Prototype Pollution
All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.