Weaknesses of type CWE-1321

439 results

Poluição de Protótipo

É a capacidade de um atacante modificar o protótipo de objetos JavaScript (ou estruturas similares em outras linguagens), afetando todas as instâncias daquela classe. Isso ocorre quando o código não valida ou sanitiza chaves de entrada antes de atribuir propriedades a objetos, permitindo acesso a `__proto__`, `constructor.prototype` ou `prototype`. O risco é grave: dados sensíveis podem ser injetados globalmente, lógica de autenticação contornada, ou até código executado.

Example

Um servidor Node.js recebe um objeto JSON `{"name": "João", "__proto__": {"isAdmin": true}}` e o mescla ingenuamente em um objeto de usuário via `Object.assign(usuario, entrada)`. De repente, todos os novos objetos criados herdam `isAdmin: true`, elevando privilégios sem qualquer validação real.

How to mitigate

Nunca confie em chaves de entrada: valide e bloqueie explicitamente chaves perigosas como `__proto__`, `constructor`, `prototype` antes de atribuir. Use `Object.create(null)` para criar objetos sem protótipo herdado, ou bibliotecas seguras como `lodash.merge` com configurações defensivas. Em APIs REST, considere esquemas estritos (JSON Schema) que rejeitam propriedades inesperadas.

CVE-2025-49223CRITICALbillboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to executeEPSS 0.9%CVE-2023-26135HIGHAll versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.EPSS 0.9%CVE-2023-26139HIGHVersions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() funcEPSS 0.9%CVE-2024-38988CRITICALalizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerabiEPSS 0.9%CVE-2021-3815HIGHPrototype Pollution in fabiocaccamo/utils.jsEPSS 0.9%CVE-2026-42033HIGHAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingEPSS 0.9%CVE-2026-33228HIGHflatted: Prototype Pollution via parse()EPSS 0.9%CVE-2026-44495HIGHAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeEPSS 0.9%CVE-2025-13204CRITICALCVE-2025-13204EPSS 0.9%CVE-2026-42231CRITICALn8n: Prototype Pollution in XML Webhook Body Parser Leads to RCEEPSS 0.9%CVE-2024-38999CRITICALjrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows EPSS 0.8%CVE-2026-61534CRITICALYayson: Prototype pollution in the Store/LegacyStore deserializationEPSS 0.8%CVE-2022-41713MEDIUMdeep-object-diff 1.1.0 - Prototype PollutionEPSS 0.8%CVE-2026-44005CRITICALvm2: Sandbox escapeEPSS 0.8%CVE-2024-39001MEDIUMag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability alEPSS 0.8%CVE-2024-38992HIGHairvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackerEPSS 0.8%CVE-2024-38991HIGHakbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to exEPSS 0.8%CVE-2024-38985CRITICALjanryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/inEPSS 0.8%CVE-2024-29651HIGHA Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary codeEPSS 0.8%CVE-2026-33696CRITICALn8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCEEPSS 0.8%