Fallos del tipo CWE-1321

436 resultados

Poluição de Protótipo

Ocorre quando um atacante modifica o protótipo de um objeto JavaScript (ou estrutura similar em outras linguagens), afetando todos os objetos criados a partir dele. Isso acontece quando código inseguro copia propriedades de entrada do usuário diretamente para objetos sem validação, permitindo que chaves como '__proto__' ou 'constructor.prototype' sejam manipuladas.

Ejemplo

Um servidor Node.js faz merge de um JSON enviado pelo cliente em um objeto global de configuração usando Object.assign(). Um atacante envia {"__proto__": {"isAdmin": true}} e, com isso, todos os novos objetos herdam isAdmin=true, contornando autenticação.

Cómo mitigar

Valide e sanitize chaves de entrada, bloqueando '__proto__', 'constructor' e 'prototype'. Use Object.create(null) para objetos sem herança ou operações seguras como Object.defineProperty(). Em frameworks modernos, prefira bibliotecas que já tratam isso (ex: deep-clone com whitelist de propriedades).

CVE-2026-104852HIGHGraphQL Tools has prototype pollution in well-established utility function `mergeDeep`EPSS 0.5%CVE-2021-4278MEDIUMcronvel tree-kit prototype pollutionEPSS 0.4%CVE-2026-78179MEDIUMrexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollutionEPSS 0.4%CVE-2026-15697MEDIUMsvgdotjs svg.js npm Package API EventTarget.on prototype pollutionEPSS 0.4%CVE-2026-16151MEDIUMCartoDB carto-api-client filters.ts addFilter prototype pollutionEPSS 0.4%CVE-2026-15699MEDIUMspencermountain compromise Public Root API extend.js nlp.extend prototype pollutionEPSS 0.4%CVE-2026-16150MEDIUMRobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollutionEPSS 0.4%CVE-2026-113666HIGHApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceEPSS 0.4%CVE-2024-57071HIGHA prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a cEPSS 0.4%CVE-2024-57069HIGHA prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafteEPSS 0.4%CVE-2024-57084HIGHA prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service (DoS) via supplying aEPSS 0.4%CVE-2024-57064HIGHA prototype pollution in the lib.setValue function of @syncfusion/ej2-spreadsheet v27.2.2 allows attackers to cause a Denial of Service (DoSEPSS 0.4%CVE-2024-57086HIGHA prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoSEPSS 0.4%CVE-2026-89011HIGHisomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfoEPSS 0.4%CVE-2024-57078HIGHA prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafEPSS 0.4%CVE-2024-57067HIGHA prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a craftedEPSS 0.4%CVE-2024-57080HIGHA prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a cEPSS 0.4%CVE-2026-15607MEDIUMtanstack db Alias Path select.ts select prototype pollutionEPSS 0.4%CVE-2025-57321CRITICALA Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to injEPSS 0.4%CVE-2023-45811HIGHPrototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscatorEPSS 0.4%