Weaknesses of type CWE-1321

380 results

Poluição de Protótipo

É a capacidade de um atacante modificar o protótipo de objetos JavaScript (ou estruturas similares em outras linguagens), afetando todas as instâncias daquela classe. Isso ocorre quando o código não valida ou sanitiza chaves de entrada antes de atribuir propriedades a objetos, permitindo acesso a `__proto__`, `constructor.prototype` ou `prototype`. O risco é grave: dados sensíveis podem ser injetados globalmente, lógica de autenticação contornada, ou até código executado.

Example

Um servidor Node.js recebe um objeto JSON `{"name": "João", "__proto__": {"isAdmin": true}}` e o mescla ingenuamente em um objeto de usuário via `Object.assign(usuario, entrada)`. De repente, todos os novos objetos criados herdam `isAdmin: true`, elevando privilégios sem qualquer validação real.

How to mitigate

Nunca confie em chaves de entrada: valide e bloqueie explicitamente chaves perigosas como `__proto__`, `constructor`, `prototype` antes de atribuir. Use `Object.create(null)` para criar objetos sem protótipo herdado, ou bibliotecas seguras como `lodash.merge` com configurações defensivas. Em APIs REST, considere esquemas estritos (JSON Schema) que rejeitam propriedades inesperadas.

CVE-2026-44789CRITICALn8n: HTTP Request Node Pagination Prototype Pollution to RCEEPSS 0.5%CVE-2024-38994HIGHamoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to eEPSS 0.5%CVE-2024-39853MEDIUMadolph_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers tEPSS 0.5%CVE-2025-3193HIGHVersions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() functionEPSS 0.5%CVE-2024-38987MEDIUMaofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to EPSS 0.5%CVE-2024-45815MEDIUMPrototype pollution in @backstage/plugin-catalog-backendEPSS 0.5%CVE-2026-32621CRITICALApollo Federation has prototype pollution via incomplete key sanitizationEPSS 0.5%CVE-2026-32886HIGHParse Server's Cloud function dispatch crashes server via prototype chain traversalEPSS 0.5%CVE-2026-48713CRITICALi18next-fs-backend: Prototype pollution via crafted missing-key stringEPSS 0.5%CVE-2026-48714CRITICALi18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting namesEPSS 0.5%CVE-2025-8101HIGHLinkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)EPSS 0.5%CVE-2026-26021CRITICALPrototype pollution in set-inEPSS 0.5%CVE-2025-13158CRITICALapidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js workerEPSS 0.5%CVE-2026-81887MEDIUMLivewire DOM-based cross-site scripting during client-side state handlingEPSS 0.5%CVE-2025-54803HIGHjs-toml is vulnerable to Prototype PollutionEPSS 0.5%CVE-2024-39003HIGHamoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers toEPSS 0.5%CVE-2024-57077CRITICALThe latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can suEPSS 0.5%CVE-2026-30939HIGHParse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain ResolutionEPSS 0.5%CVE-2024-57066HIGHA prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplyingEPSS 0.5%CVE-2025-57354MEDIUMA vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input inEPSS 0.5%