Falhas do tipo CWE-1321

436 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2026-71553HIGHApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoSEPSS 0.4%CVE-2025-57351MEDIUMA prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided keEPSS 0.4%CVE-2026-105857CRITICALPayload: RCE in Payload Form BuilderEPSS 0.4%CVE-2026-2964LOWhiguma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollutionEPSS 0.4%CVE-2026-15187MEDIUMenquirer Public Package API Enquirer.set prototype pollutionEPSS 0.4%CVE-2026-33672MEDIUMPicomatch: Method Injection in POSIX Character Classes causes incorrect Glob MatchingEPSS 0.4%CVE-2026-15598MEDIUMantv layout object.js setNestedValue prototype pollutionEPSS 0.4%CVE-2026-67316MEDIUMaxios before 1.18.0 Prototype Pollution via bodyless methodsEPSS 0.4%CVE-2026-16266MEDIUMVersions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attackerEPSS 0.4%CVE-2025-3197MEDIUMVersions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function eEPSS 0.4%CVE-2026-24766MEDIUMNocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoSEPSS 0.4%CVE-2025-64718MEDIUMjs-yaml has prototype pollution in merge (<<)EPSS 0.4%CVE-2024-36577HIGHapphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.EPSS 0.4%CVE-2025-62374MEDIUMParse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIsEPSS 0.4%CVE-2024-36574MEDIUMA Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-jsoEPSS 0.4%CVE-2024-39018MEDIUMharvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows EPSS 0.4%CVE-2026-34622HIGHAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.4%CVE-2026-101905HIGHAxios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionEPSS 0.4%CVE-2026-25754HIGHAdonisJS multipart body parsing has Prototype Pollution issueEPSS 0.4%CVE-2025-63703CRITICALnpm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().EPSS 0.4%