Weaknesses of type CWE-1321

380 results

Poluição de Protótipo

É a capacidade de um atacante modificar o protótipo de objetos JavaScript (ou estruturas similares em outras linguagens), afetando todas as instâncias daquela classe. Isso ocorre quando o código não valida ou sanitiza chaves de entrada antes de atribuir propriedades a objetos, permitindo acesso a `__proto__`, `constructor.prototype` ou `prototype`. O risco é grave: dados sensíveis podem ser injetados globalmente, lógica de autenticação contornada, ou até código executado.

Example

Um servidor Node.js recebe um objeto JSON `{"name": "João", "__proto__": {"isAdmin": true}}` e o mescla ingenuamente em um objeto de usuário via `Object.assign(usuario, entrada)`. De repente, todos os novos objetos criados herdam `isAdmin: true`, elevando privilégios sem qualquer validação real.

How to mitigate

Nunca confie em chaves de entrada: valide e bloqueie explicitamente chaves perigosas como `__proto__`, `constructor`, `prototype` antes de atribuir. Use `Object.create(null)` para criar objetos sem protótipo herdado, ou bibliotecas seguras como `lodash.merge` com configurações defensivas. Em APIs REST, considere esquemas estritos (JSON Schema) que rejeitam propriedades inesperadas.

CVE-2020-36632MEDIUMhughsk flat index.js unflatten prototype pollutionEPSS 1.1%CVE-2022-39357HIGHWinter vulnerable to Prototype Pollution in Snowboard frameworkEPSS 1.1%CVE-2023-26121HIGHAll versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its pEPSS 1.1%CVE-2024-38989CRITICALizatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to exEPSS 1.1%CVE-2021-4279MEDIUMStarcounter-Jack JSON-Patch prototype pollutionEPSS 1.1%CVE-2021-4264MEDIUMLinkedIn dustjs prototype pollutionEPSS 1.1%CVE-2023-26132HIGHVersions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and theEPSS 1.1%CVE-2022-31106HIGHPrototype Pollution in underscore.deepEPSS 1.1%CVE-2023-1717CRITICALBitrix24 Cross-Site Scripting (XSS) via Client-side Prototype PollutionEPSS 1.1%CVE-2026-44494HIGHAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`EPSS 1.0%CVE-2022-4742MEDIUMjson-pointer index.js set prototype pollutionEPSS 1.0%CVE-2021-32736HIGHImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helperEPSS 1.0%CVE-2024-23339MEDIUMhoolock does not block Prototype pollution with object-path related utilitiesEPSS 1.0%CVE-2023-2972MEDIUMPrototype Pollution in antfu/utilsEPSS 1.0%CVE-2023-30533HIGHSheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, wherEPSS 1.0%CVE-2024-38986CRITICALPrototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other iEPSS 1.0%CVE-2023-23917HIGHA prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any uEPSS 1.0%CVE-2026-29063HIGHImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableEPSS 1.0%CVE-2024-39012CRITICALais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackersEPSS 1.0%CVE-2024-38984CRITICALPrototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via theEPSS 1.0%