Weaknesses of type CWE-1321

439 results

Poluição de Protótipo

É a capacidade de um atacante modificar o protótipo de objetos JavaScript (ou estruturas similares em outras linguagens), afetando todas as instâncias daquela classe. Isso ocorre quando o código não valida ou sanitiza chaves de entrada antes de atribuir propriedades a objetos, permitindo acesso a `__proto__`, `constructor.prototype` ou `prototype`. O risco é grave: dados sensíveis podem ser injetados globalmente, lógica de autenticação contornada, ou até código executado.

Example

Um servidor Node.js recebe um objeto JSON `{"name": "João", "__proto__": {"isAdmin": true}}` e o mescla ingenuamente em um objeto de usuário via `Object.assign(usuario, entrada)`. De repente, todos os novos objetos criados herdam `isAdmin: true`, elevando privilégios sem qualquer validação real.

How to mitigate

Nunca confie em chaves de entrada: valide e bloqueie explicitamente chaves perigosas como `__proto__`, `constructor`, `prototype` antes de atribuir. Use `Object.create(null)` para criar objetos sem protótipo herdado, ou bibliotecas seguras como `lodash.merge` com configurações defensivas. Em APIs REST, considere esquemas estritos (JSON Schema) que rejeitam propriedades inesperadas.

CVE-2026-71438LOWMermaid configuration APIs allow prototype pollutionEPSS 0.4%CVE-2026-118243MEDIUMHighcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`EPSS 0.4%CVE-2025-31475MEDIUMtarteaucitron.js allows prototype pollution via custom text injectionEPSS 0.4%CVE-2026-59876MEDIUMprotobufjs: Text Format string map parsing can mutate returned map object prototypeEPSS 0.3%CVE-2026-69200LOWnode-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)EPSS 0.3%CVE-2026-53609CRITICALApostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassEPSS 0.3%CVE-2026-113659MEDIUMApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersEPSS 0.3%CVE-2025-57353MEDIUMThe Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient vaEPSS 0.3%CVE-2024-54156MEDIUMIn JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attackEPSS 0.3%CVE-2025-8083HIGHVuetify Prototype Pollution via Preset optionsEPSS 0.3%CVE-2026-57926LOWIn JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attackEPSS 0.3%CVE-2026-2950MEDIUMlodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`EPSS 0.3%CVE-2026-34626MEDIUMAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.3%CVE-2026-6621MEDIUM1024bit extend-deep index.js prototype pollutionEPSS 0.3%CVE-2026-6594MEDIUMbrikcss merge prototype pollutionEPSS 0.3%CVE-2026-14893HIGHIBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container imageEPSS 0.3%CVE-2026-44490MEDIUMAxios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsEPSS 0.3%CVE-2026-122131MEDIUMJoi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language KeyEPSS 0.3%CVE-2025-53626MEDIUMpdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluationEPSS 0.3%CVE-2025-57320MEDIUMjson-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData fuEPSS 0.3%