Falhas do tipo CWE-1321

379 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2026-86078MEDIUMn8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of ServiceEPSS 0.3%CVE-2026-85063MEDIUMnode-csv: Prototype replacement still reachable via columns pathEPSS 0.3%CVE-2025-57320MEDIUMjson-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData fuEPSS 0.3%CVE-2026-65913MEDIUMDOMPurify before 3.3.2 Prototype Pollution via USE_PROFILESEPSS 0.3%CVE-2026-2950MEDIUMlodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`EPSS 0.3%CVE-2026-46509HIGHdeepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')EPSS 0.3%CVE-2026-45302HIGHPrototype Pollution in parse-nested-form-data via `__proto__` in FormData field namesEPSS 0.3%CVE-2026-12209MEDIUMRubyLouvre avalon Template Filter index.js prototype pollutionEPSS 0.3%CVE-2026-12208MEDIUMjsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollutionEPSS 0.3%CVE-2026-40190MEDIUMLangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`EPSS 0.3%CVE-2025-57350HIGHThe csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulneraEPSS 0.3%CVE-2026-72749HIGHn8n before 1.123.67 Prototype Pollution via Edit FieldsEPSS 0.3%CVE-2026-71553HIGHApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoSEPSS 0.3%CVE-2026-41690HIGHPrototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parametersEPSS 0.3%CVE-2024-14020LOWcarboneio carbone Formatter input.js prototype pollutionEPSS 0.3%CVE-2026-44490MEDIUMAxios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsEPSS 0.3%CVE-2026-44483HIGHRVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)EPSS 0.3%CVE-2026-48170CRITICALscimPatch vulnerable to prototype pollution via unfiltered keys in patchEPSS 0.3%CVE-2026-81994HIGHAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.3%CVE-2026-14574MEDIUMIn Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges prefEPSS 0.3%