Fallos del tipo CWE-1321

439 resultados

Poluição de Protótipo

Ocorre quando um atacante modifica o protótipo de um objeto JavaScript (ou estrutura similar em outras linguagens), afetando todos os objetos criados a partir dele. Isso acontece quando código inseguro copia propriedades de entrada do usuário diretamente para objetos sem validação, permitindo que chaves como '__proto__' ou 'constructor.prototype' sejam manipuladas.

Ejemplo

Um servidor Node.js faz merge de um JSON enviado pelo cliente em um objeto global de configuração usando Object.assign(). Um atacante envia {"__proto__": {"isAdmin": true}} e, com isso, todos os novos objetos herdam isAdmin=true, contornando autenticação.

Cómo mitigar

Valide e sanitize chaves de entrada, bloqueando '__proto__', 'constructor' e 'prototype'. Use Object.create(null) para objetos sem herança ou operações seguras como Object.defineProperty(). Em frameworks modernos, prefira bibliotecas que já tratam isso (ex: deep-clone com whitelist de propriedades).

CVE-2026-107301MEDIUMmsgpack5: Partial options disable prototype protectionEPSS 0.4%CVE-2026-77083MEDIUMn8n before 1.123.69 Code Node Sandbox Escape via Function.prototype PollutionEPSS 0.4%CVE-2026-32878MEDIUMParse Server vulnerable to schema poisoning via prototype pollution in deep copyEPSS 0.4%CVE-2026-49459MEDIUMDOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMEPSS 0.4%CVE-2025-55195HIGH@std/toml Prototype Pollution in Node.js and BrowserEPSS 0.4%CVE-2026-118247MEDIUMHighcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.EPSS 0.4%CVE-2026-118249HIGHHighcharts: series column construction writes to Object.prototypeEPSS 0.4%CVE-2026-118250HIGHHighcharts: dotted series.keys paths write to Object.prototypeEPSS 0.4%CVE-2026-27837MEDIUMDottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform()EPSS 0.4%CVE-2025-62410CRITICAL--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-domEPSS 0.4%CVE-2026-46681HIGH@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnPropertyEPSS 0.4%CVE-2026-44483HIGHRVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)EPSS 0.4%CVE-2026-86535HIGHApache Thrift: A JSON member name can stall the Node server's event loop indefinitelyEPSS 0.4%CVE-2026-92781MEDIUMBuilder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributesEPSS 0.4%CVE-2026-82257MEDIUMSvelteKit before 2.69.1 Prototype Pollution via File InputEPSS 0.4%CVE-2025-57324MEDIUMparse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeStatEPSS 0.4%CVE-2026-54639HIGHStyle Dictionary - Prototype Pollution in convertTokenData utility functionEPSS 0.4%CVE-2025-57352MEDIUMA vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in theEPSS 0.4%CVE-2026-97151HIGHmammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafEPSS 0.4%CVE-2026-109758CRITICALPerforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized accEPSS 0.4%