Falhas do tipo CWE-1321

378 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2024-39012CRITICALais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackersEPSS 1.0%CVE-2023-30363CRITICALvConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.EPSS 1.0%CVE-2024-21509MEDIUMVersions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user EPSS 1.0%CVE-2023-26106HIGHAll versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file. EPSS 0.9%CVE-2023-45282HIGHIn NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.EPSS 0.9%CVE-2022-36059HIGHPrototype pollution in matrix-js-sdkEPSS 0.9%CVE-2023-46308CRITICALIn Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.EPSS 0.9%CVE-2022-41878HIGHParse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code TriggersEPSS 0.9%CVE-2026-24888MEDIUMMaker.js Vulnerable to Unsafe Property Copying in makerjs.extendObjectEPSS 0.9%CVE-2024-39011CRITICALPrototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and causeEPSS 0.9%CVE-2026-46625HIGHJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionEPSS 0.9%CVE-2024-39008CRITICALrobinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attEPSS 0.9%CVE-2024-39010CRITICALchase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allEPSS 0.9%CVE-2026-28794CRITICALoRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` DeserializationEPSS 0.9%CVE-2022-36060HIGHPrototype pollution in matrix-react-sdkEPSS 0.9%CVE-2023-26135HIGHAll versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.EPSS 0.9%CVE-2024-57708MEDIUMAn issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.EPSS 0.9%CVE-2023-26139HIGHVersions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() funcEPSS 0.9%CVE-2022-25904HIGHPrototype PollutionEPSS 0.9%CVE-2022-41879HIGHParse Server subject to Prototype pollution via Cloud Code WebhooksEPSS 0.9%