Falhas do tipo CWE-1321

436 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2023-23917HIGHA prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any uEPSS 1.0%CVE-2024-38984CRITICALPrototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via theEPSS 1.0%CVE-2024-39012CRITICALais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackersEPSS 1.0%CVE-2024-38983CRITICALPrototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) andEPSS 1.0%CVE-2023-30363CRITICALvConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.EPSS 1.0%CVE-2026-18420HIGHRCE via Prototype Pollution in OpenSearch DashboardsEPSS 1.0%CVE-2024-21509MEDIUMVersions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user EPSS 1.0%CVE-2022-21169HIGHPrototype PollutionEPSS 1.0%CVE-2022-41878HIGHParse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code TriggersEPSS 1.0%CVE-2023-26106HIGHAll versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file. EPSS 0.9%CVE-2022-25904HIGHPrototype PollutionEPSS 0.9%CVE-2023-46308CRITICALIn Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.EPSS 0.9%CVE-2022-36059HIGHPrototype pollution in matrix-js-sdkEPSS 0.9%CVE-2024-57708MEDIUMAn issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.EPSS 0.9%CVE-2026-46625HIGHJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionEPSS 0.9%CVE-2024-39011CRITICALPrototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and causeEPSS 0.9%CVE-2024-39008CRITICALrobinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attEPSS 0.9%CVE-2024-39010CRITICALchase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allEPSS 0.9%CVE-2022-36060HIGHPrototype pollution in matrix-react-sdkEPSS 0.9%CVE-2025-49223CRITICALbillboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to executeEPSS 0.9%