Falhas do tipo CWE-1321

378 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2025-57325HIGHrollbar is a package designed to effortlessly track and debug errors in JavaScript applications. This package includes advanced error trackiEPSS 0.4%CVE-2025-57327HIGHspmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc versionEPSS 0.4%CVE-2026-54335LOWFeathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__EPSS 0.4%CVE-2024-39000MEDIUMadolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers EPSS 0.4%CVE-2026-63376HIGHtoml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path DesynchronizationEPSS 0.4%CVE-2026-73647MEDIUMQuasar Framework: Prototype pollution in Quasar extend() utilityEPSS 0.4%CVE-2026-25754HIGHAdonisJS multipart body parsing has Prototype Pollution issueEPSS 0.4%CVE-2026-8657HIGHVersions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/forEPSS 0.4%CVE-2026-34221HIGHMikroORM has Prototype Pollution in Utils.mergeEPSS 0.4%CVE-2026-44290HIGHprotobufjs: Process-wide denial of service through unsafe option pathsEPSS 0.4%CVE-2026-30226MEDIUMdevalue has prototype pollution in devalue.parse and devalue.unflattenEPSS 0.4%CVE-2026-2964LOWhiguma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollutionEPSS 0.4%CVE-2026-73562MEDIUMMongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)EPSS 0.4%CVE-2026-24766MEDIUMNocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoSEPSS 0.4%CVE-2025-57820HIGHSvelte devalue vulnerable to prototype pollutionEPSS 0.4%CVE-2025-62517MEDIUMRollbar.js Prototype Pollution Vulnerability in merge()EPSS 0.4%CVE-2026-49459MEDIUMDOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMEPSS 0.4%CVE-2026-93753HIGHdeepmerge through 4.3.1 Prototype Poisoning via mergeObjectEPSS 0.4%CVE-2026-54639HIGHStyle Dictionary - Prototype Pollution in convertTokenData utility functionEPSS 0.4%CVE-2026-55091HIGHflat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id keyEPSS 0.4%