Falhas do tipo CWE-1321

378 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2026-67316MEDIUMaxios before 1.18.0 Prototype Pollution via bodyless methodsEPSS 0.4%CVE-2025-57352MEDIUMA vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in theEPSS 0.4%CVE-2026-67314MEDIUMaxios before 1.18.0 Prototype Pollution via auth subfieldsEPSS 0.4%CVE-2025-62410CRITICAL--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-domEPSS 0.4%CVE-2026-48819MEDIUMHey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` keyEPSS 0.4%CVE-2026-92779HIGHBuilder.io Gen2 SDKs through 5.2.11 Prototype Pollution via BindingsEPSS 0.4%CVE-2025-57324MEDIUMparse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeStatEPSS 0.4%CVE-2026-59876MEDIUMprotobufjs: Text Format string map parsing can mutate returned map object prototypeEPSS 0.3%CVE-2025-57353MEDIUMThe Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient vaEPSS 0.3%CVE-2026-32878MEDIUMParse Server vulnerable to schema poisoning via prototype pollution in deep copyEPSS 0.3%CVE-2025-31475MEDIUMtarteaucitron.js allows prototype pollution via custom text injectionEPSS 0.3%CVE-2024-54156MEDIUMIn JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attackEPSS 0.3%CVE-2025-8083HIGHVuetify Prototype Pollution via Preset optionsEPSS 0.3%CVE-2026-57926LOWIn JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attackEPSS 0.3%CVE-2026-34626MEDIUMAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.3%CVE-2026-6621MEDIUM1024bit extend-deep index.js prototype pollutionEPSS 0.3%CVE-2026-6594MEDIUMbrikcss merge prototype pollutionEPSS 0.3%CVE-2026-69200LOWnode-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)EPSS 0.3%CVE-2026-78179MEDIUMrexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollutionEPSS 0.3%CVE-2025-55195HIGH@std/toml Prototype Pollution in Node.js and BrowserEPSS 0.3%