Weaknesses of type CWE-1321

380 results

Poluição de Protótipo

É a capacidade de um atacante modificar o protótipo de objetos JavaScript (ou estruturas similares em outras linguagens), afetando todas as instâncias daquela classe. Isso ocorre quando o código não valida ou sanitiza chaves de entrada antes de atribuir propriedades a objetos, permitindo acesso a `__proto__`, `constructor.prototype` ou `prototype`. O risco é grave: dados sensíveis podem ser injetados globalmente, lógica de autenticação contornada, ou até código executado.

Example

Um servidor Node.js recebe um objeto JSON `{"name": "João", "__proto__": {"isAdmin": true}}` e o mescla ingenuamente em um objeto de usuário via `Object.assign(usuario, entrada)`. De repente, todos os novos objetos criados herdam `isAdmin: true`, elevando privilégios sem qualquer validação real.

How to mitigate

Nunca confie em chaves de entrada: valide e bloqueie explicitamente chaves perigosas como `__proto__`, `constructor`, `prototype` antes de atribuir. Use `Object.create(null)` para criar objetos sem protótipo herdado, ou bibliotecas seguras como `lodash.merge` com configurações defensivas. Em APIs REST, considere esquemas estritos (JSON Schema) que rejeitam propriedades inesperadas.

CVE-2024-57086HIGHA prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoSEPSS 0.4%CVE-2025-32014MEDIUMestree-util-value-to-estree allows prototype pollution in generated ESTreeEPSS 0.4%CVE-2026-15607MEDIUMtanstack db Alias Path select.ts select prototype pollutionEPSS 0.4%CVE-2025-57321CRITICALA Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to injEPSS 0.4%CVE-2025-57351MEDIUMA prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided keEPSS 0.4%CVE-2026-71553HIGHApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoSEPSS 0.4%CVE-2026-15187MEDIUMenquirer Public Package API Enquirer.set prototype pollutionEPSS 0.4%CVE-2021-4278MEDIUMcronvel tree-kit prototype pollutionEPSS 0.4%CVE-2026-67316MEDIUMaxios before 1.18.0 Prototype Pollution via bodyless methodsEPSS 0.4%CVE-2025-55164HIGHcontent-security-policy-parser Prototype Pollution Vulnerability May Lead to RCEEPSS 0.4%CVE-2026-15598MEDIUMantv layout object.js setNestedValue prototype pollutionEPSS 0.4%CVE-2026-16266MEDIUMVersions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attackerEPSS 0.4%CVE-2024-36577HIGHapphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.EPSS 0.4%CVE-2024-36574MEDIUMA Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-jsoEPSS 0.4%CVE-2024-39018MEDIUMharvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows EPSS 0.4%CVE-2025-63703CRITICALnpm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().EPSS 0.4%CVE-2023-45811HIGHPrototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscatorEPSS 0.4%CVE-2025-57323HIGHmpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mpEPSS 0.4%CVE-2025-57326HIGHA Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject propertiesEPSS 0.4%CVE-2026-67314MEDIUMaxios before 1.18.0 Prototype Pollution via auth subfieldsEPSS 0.4%