Fallos del tipo CWE-1321

378 resultados

Poluição de Protótipo

Ocorre quando um atacante modifica o protótipo de um objeto JavaScript (ou estrutura similar em outras linguagens), afetando todos os objetos criados a partir dele. Isso acontece quando código inseguro copia propriedades de entrada do usuário diretamente para objetos sem validação, permitindo que chaves como '__proto__' ou 'constructor.prototype' sejam manipuladas.

Ejemplo

Um servidor Node.js faz merge de um JSON enviado pelo cliente em um objeto global de configuração usando Object.assign(). Um atacante envia {"__proto__": {"isAdmin": true}} e, com isso, todos os novos objetos herdam isAdmin=true, contornando autenticação.

Cómo mitigar

Valide e sanitize chaves de entrada, bloqueando '__proto__', 'constructor' e 'prototype'. Use Object.create(null) para objetos sem herança ou operações seguras como Object.defineProperty(). Em frameworks modernos, prefira bibliotecas que já tratam isso (ex: deep-clone com whitelist de propriedades).

CVE-2026-67316MEDIUMaxios before 1.18.0 Prototype Pollution via bodyless methodsEPSS 0.4%CVE-2025-57352MEDIUMA vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in theEPSS 0.4%CVE-2026-67314MEDIUMaxios before 1.18.0 Prototype Pollution via auth subfieldsEPSS 0.4%CVE-2025-62410CRITICAL--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-domEPSS 0.4%CVE-2026-48819MEDIUMHey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` keyEPSS 0.4%CVE-2026-92779HIGHBuilder.io Gen2 SDKs through 5.2.11 Prototype Pollution via BindingsEPSS 0.4%CVE-2025-57324MEDIUMparse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeStatEPSS 0.4%CVE-2026-59876MEDIUMprotobufjs: Text Format string map parsing can mutate returned map object prototypeEPSS 0.3%CVE-2025-57353MEDIUMThe Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient vaEPSS 0.3%CVE-2026-32878MEDIUMParse Server vulnerable to schema poisoning via prototype pollution in deep copyEPSS 0.3%CVE-2025-31475MEDIUMtarteaucitron.js allows prototype pollution via custom text injectionEPSS 0.3%CVE-2024-54156MEDIUMIn JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attackEPSS 0.3%CVE-2025-8083HIGHVuetify Prototype Pollution via Preset optionsEPSS 0.3%CVE-2026-57926LOWIn JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attackEPSS 0.3%CVE-2026-34626MEDIUMAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.3%CVE-2026-6621MEDIUM1024bit extend-deep index.js prototype pollutionEPSS 0.3%CVE-2026-6594MEDIUMbrikcss merge prototype pollutionEPSS 0.3%CVE-2026-69200LOWnode-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)EPSS 0.3%CVE-2026-78179MEDIUMrexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollutionEPSS 0.3%CVE-2025-55195HIGH@std/toml Prototype Pollution in Node.js and BrowserEPSS 0.3%