Falhas do tipo CWE-1321

436 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2026-42232CRITICALn8n: XML Node Prototype Pollution to RCEEPSS 0.5%CVE-2025-63704CRITICALNPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query paramEPSS 0.5%CVE-2026-105858HIGHPayload: Remote Code Execution through first-registerEPSS 0.5%CVE-2026-8161HIGHmultiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught ExceptionEPSS 0.5%CVE-2026-30226MEDIUMdevalue has prototype pollution in devalue.parse and devalue.unflattenEPSS 0.5%CVE-2026-101908MEDIUMAxios: Prototype pollution gadget in fetch adapter can alter outbound requestsEPSS 0.5%CVE-2024-57063HIGHA prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a cEPSS 0.5%CVE-2026-49252CRITICALdeepstream is vulnerable to prototype pollutionEPSS 0.5%CVE-2025-55164HIGHcontent-security-policy-parser Prototype Pollution Vulnerability May Lead to RCEEPSS 0.5%CVE-2024-38997MEDIUMadolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows aEPSS 0.5%CVE-2026-91860MEDIUMPrototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep MergeEPSS 0.5%CVE-2026-45325HIGHGestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPathEPSS 0.5%CVE-2026-54756MEDIUMJodit Editor: Prototype pollution via Jodit.configure() / ConfigMergeEPSS 0.5%CVE-2026-21854CRITICALTarkov Data Manager Authentication Bypass vulnerabilityEPSS 0.5%CVE-2024-34698MEDIUMPrototype Pollution in getQueryParam Function (URL Query Parser)EPSS 0.5%CVE-2026-15702MEDIUMtamagui config.ts updateConfig prototype pollutionEPSS 0.5%CVE-2026-15698MEDIUMkofrasa mingo Update API updateMany prototype pollutionEPSS 0.5%CVE-2025-32014MEDIUMestree-util-value-to-estree allows prototype pollution in generated ESTreeEPSS 0.5%CVE-2026-54737HIGH@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property MergingEPSS 0.5%CVE-2026-104852HIGHGraphQL Tools has prototype pollution in well-established utility function `mergeDeep`EPSS 0.5%