Falhas do tipo CWE-1321

436 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2025-54803HIGHjs-toml is vulnerable to Prototype PollutionEPSS 0.6%CVE-2026-33994MEDIUMLocutus Prototype Pollution due to incomplete fix for CVE-2026-25521EPSS 0.6%CVE-2024-21528MEDIUMAll versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improEPSS 0.6%CVE-2026-85063MEDIUMnode-csv: Prototype replacement still reachable via columns pathEPSS 0.6%CVE-2026-55451HIGHgettext-converter: Prototype pollution in js2i18next() via crafted translation keysEPSS 0.6%CVE-2026-26021CRITICALPrototype pollution in set-inEPSS 0.6%CVE-2026-70610MEDIUMElectron: contextBridge object copy honors prototype settersEPSS 0.6%CVE-2024-12556HIGHKibana Prototype Pollution can lead to code injectionEPSS 0.6%CVE-2024-36583HIGHA Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index.EPSS 0.6%CVE-2024-39016HIGHche3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerability allows attackers toEPSS 0.6%CVE-2025-66456CRITICALElysia vulnerable to prototype pollution with multiple standalone schema validationEPSS 0.6%CVE-2024-36582CRITICALalexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)EPSS 0.6%CVE-2024-57083HIGHA prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a DeniEPSS 0.6%CVE-2024-52441CRITICALWordPress Quick Learn plugin <= 1.0.1 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2024-57072HIGHA prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service (DoS)EPSS 0.6%CVE-2024-57065HIGHA prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a craEPSS 0.5%CVE-2026-48795HIGHIncomplete fix for CVE-2026-25754 in @adonisjs/bodyparserEPSS 0.5%CVE-2026-101900MEDIUMAxios: Fetch Adapter Header Injection via Inherited FormData getHeadersEPSS 0.5%CVE-2026-44966HIGHVelocity.js: Prototype Pollution in #set path assignmentEPSS 0.5%CVE-2026-32621CRITICALApollo Federation has prototype pollution via incomplete key sanitizationEPSS 0.5%