Fallos del tipo CWE-1321

439 resultados

Poluição de Protótipo

Ocorre quando um atacante modifica o protótipo de um objeto JavaScript (ou estrutura similar em outras linguagens), afetando todos os objetos criados a partir dele. Isso acontece quando código inseguro copia propriedades de entrada do usuário diretamente para objetos sem validação, permitindo que chaves como '__proto__' ou 'constructor.prototype' sejam manipuladas.

Ejemplo

Um servidor Node.js faz merge de um JSON enviado pelo cliente em um objeto global de configuração usando Object.assign(). Um atacante envia {"__proto__": {"isAdmin": true}} e, com isso, todos os novos objetos herdam isAdmin=true, contornando autenticação.

Cómo mitigar

Valide e sanitize chaves de entrada, bloqueando '__proto__', 'constructor' e 'prototype'. Use Object.create(null) para objetos sem herança ou operações seguras como Object.defineProperty(). Em frameworks modernos, prefira bibliotecas que já tratam isso (ex: deep-clone com whitelist de propriedades).

CVE-2026-101902MEDIUMAxios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP MethodEPSS 0.4%CVE-2025-57323HIGHmpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mpEPSS 0.4%CVE-2021-48012HIGHfast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOMLEPSS 0.4%CVE-2025-57326HIGHA Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject propertiesEPSS 0.4%CVE-2026-9101MEDIUMPrototype pollution in csv parsingEPSS 0.4%CVE-2026-121965MEDIUMParse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation KeyEPSS 0.4%CVE-2026-67314MEDIUMaxios before 1.18.0 Prototype Pollution via auth subfieldsEPSS 0.4%CVE-2025-57348MEDIUMThe node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allowEPSS 0.4%CVE-2026-35209HIGHdefu: Prototype pollution via `__proto__` key in defaults argumentEPSS 0.4%CVE-2026-48170CRITICALscimPatch vulnerable to prototype pollution via unfiltered keys in patchEPSS 0.4%CVE-2026-42035HIGHAxios: Header Injection via Prototype PollutionEPSS 0.4%CVE-2025-57349HIGHThe messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollutiEPSS 0.4%CVE-2022-3901HIGHVisioweb.js - Prototype Pollution can results in XSSEPSS 0.4%CVE-2026-106448HIGHStableLib: Prototype poisoning via `__proto__` map keys in CBOR decodingEPSS 0.4%CVE-2025-68130HIGHtRPC has possible prototype pollution in `experimental_nextAppDirCaller`EPSS 0.4%CVE-2026-54312HIGHn8n: Microsoft SQL Node Prototype PollutionEPSS 0.4%CVE-2026-61834MEDIUMscim-patch: Mutation of Inherited Built-in Method ObjectsEPSS 0.4%CVE-2026-112309HIGH@rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited MethodsEPSS 0.4%CVE-2026-14574MEDIUMIn Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges prefEPSS 0.4%CVE-2025-62517MEDIUMRollbar.js Prototype Pollution Vulnerability in merge()EPSS 0.4%