Fallos del tipo CWE-1321

439 resultados

Poluição de Protótipo

Ocorre quando um atacante modifica o protótipo de um objeto JavaScript (ou estrutura similar em outras linguagens), afetando todos os objetos criados a partir dele. Isso acontece quando código inseguro copia propriedades de entrada do usuário diretamente para objetos sem validação, permitindo que chaves como '__proto__' ou 'constructor.prototype' sejam manipuladas.

Ejemplo

Um servidor Node.js faz merge de um JSON enviado pelo cliente em um objeto global de configuração usando Object.assign(). Um atacante envia {"__proto__": {"isAdmin": true}} e, com isso, todos os novos objetos herdam isAdmin=true, contornando autenticação.

Cómo mitigar

Valide e sanitize chaves de entrada, bloqueando '__proto__', 'constructor' e 'prototype'. Use Object.create(null) para objetos sem herança ou operações seguras como Object.defineProperty(). Em frameworks modernos, prefira bibliotecas que já tratam isso (ex: deep-clone com whitelist de propriedades).

CVE-2025-57330HIGHThe web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in the attachToObject fEPSS 0.4%CVE-2025-57318HIGHA Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.proEPSS 0.4%CVE-2025-57327HIGHspmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc versionEPSS 0.4%CVE-2025-57328HIGHtoggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objEPSS 0.4%CVE-2025-57325HIGHrollbar is a package designed to effortlessly track and debug errors in JavaScript applications. This package includes advanced error trackiEPSS 0.4%CVE-2025-26278HIGHA prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payEPSS 0.4%CVE-2025-57329HIGHweb3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObjectEPSS 0.4%CVE-2026-84368LOWjoi: Prototype pollution via a `__proto__` language key in custom messagesEPSS 0.4%CVE-2026-84367LOWjoi: object().rename() with a template target can set the validated object's prototypeEPSS 0.4%CVE-2026-90771MEDIUMjoi before 17.13.8 and 18.2.9 Prototype Pollution via messagesEPSS 0.4%CVE-2026-54335LOWFeathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__EPSS 0.4%CVE-2026-73647MEDIUMQuasar Framework: Prototype pollution in Quasar extend() utilityEPSS 0.4%CVE-2024-39000MEDIUMadolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers EPSS 0.4%CVE-2026-34221HIGHMikroORM has Prototype Pollution in Utils.mergeEPSS 0.4%CVE-2026-111172MEDIUM@casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPathEPSS 0.4%CVE-2026-102600HIGHSocket.IO: Prototype Pollution via Unsafe Client Session LookupEPSS 0.4%CVE-2026-119569MEDIUMParse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of ServiceEPSS 0.4%CVE-2026-8657HIGHVersions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/forEPSS 0.4%CVE-2026-44290HIGHprotobufjs: Process-wide denial of service through unsafe option pathsEPSS 0.4%CVE-2025-57820HIGHSvelte devalue vulnerable to prototype pollutionEPSS 0.4%