Falhas do tipo CWE-1321

378 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2025-13204HIGHCVE-2025-13204EPSS 0.5%CVE-2026-16151MEDIUMCartoDB carto-api-client filters.ts addFilter prototype pollutionEPSS 0.4%CVE-2026-15699MEDIUMspencermountain compromise Public Root API extend.js nlp.extend prototype pollutionEPSS 0.4%CVE-2026-15697MEDIUMsvgdotjs svg.js npm Package API EventTarget.on prototype pollutionEPSS 0.4%CVE-2026-16150MEDIUMRobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollutionEPSS 0.4%CVE-2025-61140CRITICALThe value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.EPSS 0.4%CVE-2024-57084HIGHA prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service (DoS) via supplying aEPSS 0.4%CVE-2024-57071HIGHA prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a cEPSS 0.4%CVE-2024-57069HIGHA prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafteEPSS 0.4%CVE-2024-57067HIGHA prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a craftedEPSS 0.4%CVE-2024-57064HIGHA prototype pollution in the lib.setValue function of @syncfusion/ej2-spreadsheet v27.2.2 allows attackers to cause a Denial of Service (DoSEPSS 0.4%CVE-2024-57078HIGHA prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafEPSS 0.4%CVE-2024-57080HIGHA prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a cEPSS 0.4%CVE-2024-57086HIGHA prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoSEPSS 0.4%CVE-2026-78181MEDIUMractivejs ractive Keypath Ractive#set prototype pollutionEPSS 0.4%CVE-2026-78180MEDIUMalibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollutionEPSS 0.4%CVE-2026-78207CRITICALexceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note SerializationEPSS 0.4%CVE-2026-73088HIGHBrowserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)EPSS 0.4%CVE-2026-78178MEDIUMjQWidgets jqx-all.js jqxBaseFramework.extend prototype pollutionEPSS 0.4%CVE-2025-32014MEDIUMestree-util-value-to-estree allows prototype pollution in generated ESTreeEPSS 0.4%