Falhas do tipo CWE-1321

378 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2026-55451HIGHgettext-converter: Prototype pollution in js2i18next() via crafted translation keysEPSS 0.4%CVE-2026-9101MEDIUMPrototype pollution in csv parsingEPSS 0.4%CVE-2026-33672MEDIUMPicomatch: Method Injection in POSIX Character Classes causes incorrect Glob MatchingEPSS 0.4%CVE-2025-62374MEDIUMParse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIsEPSS 0.4%CVE-2025-57348MEDIUMThe node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allowEPSS 0.4%CVE-2025-64718MEDIUMjs-yaml has prototype pollution in merge (<<)EPSS 0.4%CVE-2025-3197MEDIUMVersions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function eEPSS 0.4%CVE-2026-73654HIGHTrigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoSEPSS 0.4%CVE-2026-42035HIGHAxios: Header Injection via Prototype PollutionEPSS 0.4%CVE-2022-3901HIGHVisioweb.js - Prototype Pollution can results in XSSEPSS 0.4%CVE-2025-57349HIGHThe messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollutiEPSS 0.4%CVE-2026-35209HIGHdefu: Prototype pollution via `__proto__` key in defaults argumentEPSS 0.4%CVE-2026-82404HIGHTOON: Prototype pollution when decoding untrusted TOON inputEPSS 0.4%CVE-2025-68130HIGHtRPC has possible prototype pollution in `experimental_nextAppDirCaller`EPSS 0.4%CVE-2026-54312HIGHn8n: Microsoft SQL Node Prototype PollutionEPSS 0.4%CVE-2025-57318HIGHA Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.proEPSS 0.4%CVE-2025-57329HIGHweb3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObjectEPSS 0.4%CVE-2025-57328HIGHtoggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objEPSS 0.4%CVE-2025-57330HIGHThe web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in the attachToObject fEPSS 0.4%CVE-2025-26278HIGHA prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payEPSS 0.4%