Weaknesses of type CWE-1321

439 results

Poluição de Protótipo

É a capacidade de um atacante modificar o protótipo de objetos JavaScript (ou estruturas similares em outras linguagens), afetando todas as instâncias daquela classe. Isso ocorre quando o código não valida ou sanitiza chaves de entrada antes de atribuir propriedades a objetos, permitindo acesso a `__proto__`, `constructor.prototype` ou `prototype`. O risco é grave: dados sensíveis podem ser injetados globalmente, lógica de autenticação contornada, ou até código executado.

Example

Um servidor Node.js recebe um objeto JSON `{"name": "João", "__proto__": {"isAdmin": true}}` e o mescla ingenuamente em um objeto de usuário via `Object.assign(usuario, entrada)`. De repente, todos os novos objetos criados herdam `isAdmin: true`, elevando privilégios sem qualquer validação real.

How to mitigate

Nunca confie em chaves de entrada: valide e bloqueie explicitamente chaves perigosas como `__proto__`, `constructor`, `prototype` antes de atribuir. Use `Object.create(null)` para criar objetos sem protótipo herdado, ou bibliotecas seguras como `lodash.merge` com configurações defensivas. Em APIs REST, considere esquemas estritos (JSON Schema) que rejeitam propriedades inesperadas.

CVE-2026-107301MEDIUMmsgpack5: Partial options disable prototype protectionEPSS 0.4%CVE-2026-77083MEDIUMn8n before 1.123.69 Code Node Sandbox Escape via Function.prototype PollutionEPSS 0.4%CVE-2026-32878MEDIUMParse Server vulnerable to schema poisoning via prototype pollution in deep copyEPSS 0.4%CVE-2026-49459MEDIUMDOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMEPSS 0.4%CVE-2025-55195HIGH@std/toml Prototype Pollution in Node.js and BrowserEPSS 0.4%CVE-2026-118247MEDIUMHighcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.EPSS 0.4%CVE-2026-118249HIGHHighcharts: series column construction writes to Object.prototypeEPSS 0.4%CVE-2026-118250HIGHHighcharts: dotted series.keys paths write to Object.prototypeEPSS 0.4%CVE-2026-27837MEDIUMDottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()EPSS 0.4%CVE-2025-62410CRITICAL--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-domEPSS 0.4%CVE-2026-46681HIGH@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnPropertyEPSS 0.4%CVE-2026-44483HIGHRVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)EPSS 0.4%CVE-2026-86535HIGHApache Thrift: A JSON member name can stall the Node server's event loop indefinitelyEPSS 0.4%CVE-2026-92781MEDIUMBuilder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributesEPSS 0.4%CVE-2026-82257MEDIUMSvelteKit before 2.69.1 Prototype Pollution via File InputEPSS 0.4%CVE-2025-57324MEDIUMparse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeStatEPSS 0.4%CVE-2026-54639HIGHStyle Dictionary - Prototype Pollution in convertTokenData utility functionEPSS 0.4%CVE-2025-57352MEDIUMA vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in theEPSS 0.4%CVE-2026-97151HIGHmammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafEPSS 0.4%CVE-2026-109758CRITICALPerforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized accEPSS 0.4%