Falhas do tipo CWE-1321

436 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2023-26135HIGHAll versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.EPSS 0.9%CVE-2023-26139HIGHVersions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() funcEPSS 0.9%CVE-2022-41879HIGHParse Server subject to Prototype pollution via Cloud Code WebhooksEPSS 0.9%CVE-2024-38988CRITICALalizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerabiEPSS 0.9%CVE-2021-3815HIGHPrototype Pollution in fabiocaccamo/utils.jsEPSS 0.9%CVE-2026-42033HIGHAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingEPSS 0.9%CVE-2026-33228HIGHflatted: Prototype Pollution via parse()EPSS 0.9%CVE-2026-44495HIGHAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeEPSS 0.9%CVE-2025-13204CRITICALCVE-2025-13204EPSS 0.9%CVE-2026-42231CRITICALn8n: Prototype Pollution in XML Webhook Body Parser Leads to RCEEPSS 0.9%CVE-2024-38999CRITICALjrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows EPSS 0.8%CVE-2026-61534CRITICALYayson: Prototype pollution in the Store/LegacyStore deserializationEPSS 0.8%CVE-2022-41713MEDIUMdeep-object-diff 1.1.0 - Prototype PollutionEPSS 0.8%CVE-2026-44005CRITICALvm2: Sandbox escapeEPSS 0.8%CVE-2024-39001MEDIUMag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability alEPSS 0.8%CVE-2024-38992HIGHairvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackerEPSS 0.8%CVE-2024-38991HIGHakbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to exEPSS 0.8%CVE-2024-38985CRITICALjanryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/inEPSS 0.8%CVE-2024-29651HIGHA Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary codeEPSS 0.8%CVE-2026-33696CRITICALn8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCEEPSS 0.8%