Weaknesses of type CWE-1321

381 results

Poluição de Protótipo

É a capacidade de um atacante modificar o protótipo de objetos JavaScript (ou estruturas similares em outras linguagens), afetando todas as instâncias daquela classe. Isso ocorre quando o código não valida ou sanitiza chaves de entrada antes de atribuir propriedades a objetos, permitindo acesso a `__proto__`, `constructor.prototype` ou `prototype`. O risco é grave: dados sensíveis podem ser injetados globalmente, lógica de autenticação contornada, ou até código executado.

Example

Um servidor Node.js recebe um objeto JSON `{"name": "João", "__proto__": {"isAdmin": true}}` e o mescla ingenuamente em um objeto de usuário via `Object.assign(usuario, entrada)`. De repente, todos os novos objetos criados herdam `isAdmin: true`, elevando privilégios sem qualquer validação real.

How to mitigate

Nunca confie em chaves de entrada: valide e bloqueie explicitamente chaves perigosas como `__proto__`, `constructor`, `prototype` antes de atribuir. Use `Object.create(null)` para criar objetos sem protótipo herdado, ou bibliotecas seguras como `lodash.merge` com configurações defensivas. Em APIs REST, considere esquemas estritos (JSON Schema) que rejeitam propriedades inesperadas.

CVE-2026-90771MEDIUMjoi before 17.13.8 and 18.2.9 Prototype Pollution via messagesEPSS 0.4%CVE-2026-84368LOWjoi: Prototype pollution via a `__proto__` language key in custom messagesEPSS 0.4%CVE-2026-54335LOWFeathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__EPSS 0.4%CVE-2026-84367LOWjoi: object().rename() with a template target can set the validated object's prototypeEPSS 0.4%CVE-2026-73647MEDIUMQuasar Framework: Prototype pollution in Quasar extend() utilityEPSS 0.4%CVE-2024-39000MEDIUMadolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers EPSS 0.4%CVE-2026-40190MEDIUMLangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`EPSS 0.4%CVE-2026-33916MEDIUMHandlebars.js has Prototype Pollution Leading to XSS through Partial Template InjectionEPSS 0.4%CVE-2026-42035HIGHAxios: Header Injection via Prototype PollutionEPSS 0.4%CVE-2026-53609CRITICALApostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassEPSS 0.4%CVE-2026-2950MEDIUMlodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`EPSS 0.4%CVE-2025-57820HIGHSvelte devalue vulnerable to prototype pollutionEPSS 0.4%CVE-2026-24766MEDIUMNocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoSEPSS 0.4%CVE-2026-77083MEDIUMn8n before 1.123.69 Code Node Sandbox Escape via Function.prototype PollutionEPSS 0.4%CVE-2026-49459MEDIUMDOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMEPSS 0.4%CVE-2026-92781MEDIUMBuilder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributesEPSS 0.4%CVE-2026-82257MEDIUMSvelteKit before 2.69.1 Prototype Pollution via File InputEPSS 0.4%CVE-2026-54639HIGHStyle Dictionary - Prototype Pollution in convertTokenData utility functionEPSS 0.4%CVE-2026-4239MEDIUMLagom WHMCS Template Datatables prototype pollutionEPSS 0.4%CVE-2026-97151HIGHmammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafEPSS 0.4%