Fallos del tipo CWE-1321

436 resultados

Poluição de Protótipo

Ocorre quando um atacante modifica o protótipo de um objeto JavaScript (ou estrutura similar em outras linguagens), afetando todos os objetos criados a partir dele. Isso acontece quando código inseguro copia propriedades de entrada do usuário diretamente para objetos sem validação, permitindo que chaves como '__proto__' ou 'constructor.prototype' sejam manipuladas.

Ejemplo

Um servidor Node.js faz merge de um JSON enviado pelo cliente em um objeto global de configuração usando Object.assign(). Um atacante envia {"__proto__": {"isAdmin": true}} e, com isso, todos os novos objetos herdam isAdmin=true, contornando autenticação.

Cómo mitigar

Valide e sanitize chaves de entrada, bloqueando '__proto__', 'constructor' e 'prototype'. Use Object.create(null) para objetos sem herança ou operações seguras como Object.defineProperty(). Em frameworks modernos, prefira bibliotecas que já tratam isso (ex: deep-clone com whitelist de propriedades).

CVE-2026-78654MEDIUMcleverbrush framework/deep deepExtend.ts deepExtend prototype pollutionEPSS 0.7%CVE-2025-25977CRITICALAn issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.EPSS 0.7%CVE-2023-28103HIGHPrototype pollution in matrix-react-sdkEPSS 0.7%CVE-2024-21489HIGHVersions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the EPSS 0.7%CVE-2026-105844CRITICALPayload: Prototype pollution in Payload Import Export pluginEPSS 0.7%CVE-2024-33519HIGHAuthenticated Server-Side prototype pollution Leading to Information DisclosureEPSS 0.7%CVE-2024-39014CRITICALahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to exEPSS 0.7%CVE-2024-36573CRITICALalmela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@alEPSS 0.7%CVE-2025-48054MEDIUMRadashi Vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')EPSS 0.7%CVE-2024-12629MEDIUMPrototype Pollution in Progress® Telerik® KendoReactEPSS 0.7%CVE-2024-11628MEDIUMPrototype Pollution in Progress® Telerik® Kendo UI for VueEPSS 0.7%CVE-2024-24293HIGHA Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argumenEPSS 0.7%CVE-2026-63376HIGHtoml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path DesynchronizationEPSS 0.7%CVE-2026-81887MEDIUMLivewire DOM-based cross-site scripting during client-side state handlingEPSS 0.7%CVE-2026-82404HIGHTOON: Prototype pollution when decoding untrusted TOON inputEPSS 0.7%CVE-2024-21548HIGHVersions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attaEPSS 0.7%CVE-2025-3982MEDIUMnortikin Sverchok Set Property Mk2 Node getsetprop_mk2.py SvSetPropNodeMK2 prototype pollutionEPSS 0.7%CVE-2026-59206HIGHn8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project EnumerationEPSS 0.7%CVE-2026-73088HIGHBrowserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)EPSS 0.7%CVE-2026-42041MEDIUMAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyEPSS 0.7%