Falhas do tipo CWE-1321

436 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2023-45282HIGHIn NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.EPSS 1.2%CVE-2024-38996CRITICALag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. ThisEPSS 1.2%CVE-2024-30564CRITICALAn issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted EPSS 1.2%CVE-2021-4279MEDIUMStarcounter-Jack JSON-Patch prototype pollutionEPSS 1.2%CVE-2021-4264MEDIUMLinkedIn dustjs prototype pollutionEPSS 1.2%CVE-2024-48910CRITICALDOMPurify vulnerable to tampering by prototype polutionEPSS 1.2%CVE-2023-26121HIGHAll versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its pEPSS 1.1%CVE-2024-38989CRITICALizatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to exEPSS 1.1%CVE-2022-4742MEDIUMjson-pointer index.js set prototype pollutionEPSS 1.1%CVE-2026-28794CRITICALoRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` DeserializationEPSS 1.1%CVE-2026-44494HIGHAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`EPSS 1.1%CVE-2023-26132HIGHVersions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and theEPSS 1.1%CVE-2022-31106HIGHPrototype Pollution in underscore.deepEPSS 1.1%CVE-2021-32736HIGHImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helperEPSS 1.0%CVE-2024-23339MEDIUMhoolock does not block Prototype pollution with object-path related utilitiesEPSS 1.0%CVE-2026-24888MEDIUMMaker.js Vulnerable to Unsafe Property Copying in makerjs.extendObjectEPSS 1.0%CVE-2023-2972MEDIUMPrototype Pollution in antfu/utilsEPSS 1.0%CVE-2026-29063HIGHImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableEPSS 1.0%CVE-2023-30533HIGHSheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, wherEPSS 1.0%CVE-2024-38986CRITICALPrototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other iEPSS 1.0%