Weaknesses of type CWE-1321

381 results

Poluição de Protótipo

É a capacidade de um atacante modificar o protótipo de objetos JavaScript (ou estruturas similares em outras linguagens), afetando todas as instâncias daquela classe. Isso ocorre quando o código não valida ou sanitiza chaves de entrada antes de atribuir propriedades a objetos, permitindo acesso a `__proto__`, `constructor.prototype` ou `prototype`. O risco é grave: dados sensíveis podem ser injetados globalmente, lógica de autenticação contornada, ou até código executado.

Example

Um servidor Node.js recebe um objeto JSON `{"name": "João", "__proto__": {"isAdmin": true}}` e o mescla ingenuamente em um objeto de usuário via `Object.assign(usuario, entrada)`. De repente, todos os novos objetos criados herdam `isAdmin: true`, elevando privilégios sem qualquer validação real.

How to mitigate

Nunca confie em chaves de entrada: valide e bloqueie explicitamente chaves perigosas como `__proto__`, `constructor`, `prototype` antes de atribuir. Use `Object.create(null)` para criar objetos sem protótipo herdado, ou bibliotecas seguras como `lodash.merge` com configurações defensivas. Em APIs REST, considere esquemas estritos (JSON Schema) que rejeitam propriedades inesperadas.

CVE-2026-67314MEDIUMaxios before 1.18.0 Prototype Pollution via auth subfieldsEPSS 0.4%CVE-2025-62374MEDIUMParse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIsEPSS 0.4%CVE-2025-57348MEDIUMThe node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allowEPSS 0.4%CVE-2025-3197MEDIUMVersions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function eEPSS 0.4%CVE-2025-64718MEDIUMjs-yaml has prototype pollution in merge (<<)EPSS 0.4%CVE-2026-48170CRITICALscimPatch vulnerable to prototype pollution via unfiltered keys in patchEPSS 0.4%CVE-2026-44490MEDIUMAxios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsEPSS 0.4%CVE-2022-3901HIGHVisioweb.js - Prototype Pollution can results in XSSEPSS 0.4%CVE-2025-57349HIGHThe messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollutiEPSS 0.4%CVE-2025-68130HIGHtRPC has possible prototype pollution in `experimental_nextAppDirCaller`EPSS 0.4%CVE-2026-54312HIGHn8n: Microsoft SQL Node Prototype PollutionEPSS 0.4%CVE-2026-14574MEDIUMIn Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges prefEPSS 0.4%CVE-2025-62517MEDIUMRollbar.js Prototype Pollution Vulnerability in merge()EPSS 0.4%CVE-2025-57330HIGHThe web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in the attachToObject fEPSS 0.4%CVE-2025-57329HIGHweb3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObjectEPSS 0.4%CVE-2025-57328HIGHtoggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objEPSS 0.4%CVE-2025-57325HIGHrollbar is a package designed to effortlessly track and debug errors in JavaScript applications. This package includes advanced error trackiEPSS 0.4%CVE-2025-57327HIGHspmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc versionEPSS 0.4%CVE-2025-26278HIGHA prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payEPSS 0.4%CVE-2025-57318HIGHA Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.proEPSS 0.4%