Falhas do tipo CWE-1321

378 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2024-38988CRITICALalizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerabiEPSS 0.9%CVE-2026-44495HIGHAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeEPSS 0.9%CVE-2026-42231CRITICALn8n: Prototype Pollution in XML Webhook Body Parser Leads to RCEEPSS 0.9%CVE-2021-3815HIGHPrototype Pollution in fabiocaccamo/utils.jsEPSS 0.8%CVE-2025-49223CRITICALbillboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to executeEPSS 0.8%CVE-2026-42033HIGHAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingEPSS 0.8%CVE-2026-44005CRITICALvm2: Sandbox escapeEPSS 0.8%CVE-2024-39001MEDIUMag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability alEPSS 0.8%CVE-2024-38991HIGHakbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to exEPSS 0.8%CVE-2024-38992HIGHairvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackerEPSS 0.8%CVE-2026-33228HIGHflatted: Prototype Pollution via parse()EPSS 0.8%CVE-2023-26158HIGHAll versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute EPSS 0.8%CVE-2024-29651HIGHA Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary codeEPSS 0.8%CVE-2024-38985CRITICALjanryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/inEPSS 0.8%CVE-2022-21169HIGHPrototype PollutionEPSS 0.8%CVE-2026-33696CRITICALn8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCEEPSS 0.8%CVE-2024-34148MEDIUMJenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is EPSS 0.8%CVE-2024-36580CRITICALA Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.EPSS 0.8%CVE-2024-39013CRITICAL2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute EPSS 0.8%CVE-2026-61534CRITICALYayson: Prototype pollution in the Store/LegacyStore deserializationEPSS 0.8%