Falhas do tipo CWE-1321

436 resultados

Poluição de Protótipo

Fraqueza que permite a um atacante modificar o protótipo de objetos JavaScript, afetando todas as instâncias presentes e futuras da aplicação. Ocorre quando código não valida ou filtra adequadamente dados que serão mesclados em objetos, permitindo injeção de propriedades maliciosas como '__proto__' ou 'constructor.prototype'.

Exemplo

Uma API REST que aceita JSON e faz merge direto em um objeto de configuração global (ex: `Object.assign(config, userInput)`) permite que um atacante envie {"__proto__.isAdmin": true} para ganhar privilégios em todos os usuários conectados.

Como mitigar

Valide e sanitize entradas antes de atribuições em objetos; use Object.create(null) para criar objetos sem protótipo; implemente blocklists explícitas para propriedades permitidas; considere bibliotecas especializadas em deep merge seguro (como lodash com opções de segurança).

CVE-2024-36572CRITICALPrototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaultEPSS 0.7%CVE-2024-45435CRITICALChartist 1.x through 1.3.0 allows Prototype Pollution via the extend function.EPSS 0.6%CVE-2025-27597HIGHVue I18n Prototype Pollution in `handleFlatJson`EPSS 0.6%CVE-2026-73654HIGHTrigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoSEPSS 0.6%CVE-2026-42044MEDIUMAxios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`EPSS 0.6%CVE-2026-110111HIGHXen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxiEPSS 0.6%CVE-2026-25881CRITICAL@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)EPSS 0.6%CVE-2026-78207CRITICALexceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note SerializationEPSS 0.6%CVE-2026-53676HIGHThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user whoEPSS 0.6%CVE-2025-8101HIGHLinkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)EPSS 0.6%CVE-2026-81994HIGHAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)EPSS 0.6%CVE-2023-2582MEDIUMA prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applicatioEPSS 0.6%CVE-2026-33993MEDIUMLocutus has Prototype Pollution via __proto__ Key Injection in unserialize()EPSS 0.6%CVE-2023-6293HIGHPrototype Pollution in robinbuschmann/sequelize-typescriptEPSS 0.6%CVE-2026-86078MEDIUMn8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of ServiceEPSS 0.6%CVE-2024-45277MEDIUMPrototype Pollution vulnerability in SAP HANA ClientEPSS 0.6%CVE-2026-78181MEDIUMractivejs ractive Keypath Ractive#set prototype pollutionEPSS 0.6%CVE-2026-78178MEDIUMjQWidgets jqx-all.js jqxBaseFramework.extend prototype pollutionEPSS 0.6%CVE-2026-72749HIGHn8n before 1.123.67 Prototype Pollution via Edit FieldsEPSS 0.6%CVE-2025-54803HIGHjs-toml is vulnerable to Prototype PollutionEPSS 0.6%