cve.bz

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution), page 8

Filter

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

What the weakness is: CWE-1321 at MITRE. All weaknesses

Related attack patterns (CAPEC): 3
  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs Likelihood: High · Severity: High
  • CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
  • CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels Likelihood: High · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-1321, as MITRE names them. Credits.

Ask an AI about CWE-1321

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1321: Improperly Controlled Modification of Object Prototype Attributes and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1321.html and https://cve.bz/cve/cwe/1321?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.6CVE-2024-32866EPSS 0.7%

    Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigg…

  2. 9.8CVE-2024-30564EPSS 1.2%

    An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method.

  3. 6.5CVE-2024-21509EPSS 1.0%

    Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

  4. 9.8CVE-2024-29650EPSS 1.4%

    An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.

  5. 7.5CVE-2024-21505EPSS 0.7%

    Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to…

  6. 4.4CVE-2024-2495EPSS 0.2%

    Cryptographic key vulnerability encoded in the FriendlyWrt firmware affecting version 2022-11-16.51b3d35. This vulnerability could allow an attacker to compromise the confidentiality and integrity of encrypted data.

  7. 9.8CVE-2024-27307EPSS 1.4%

    JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. Th…

  8. 6.5CVE-2024-23339EPSS 1.0%

    hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block att…

  9. 7.5CVE-2023-39296EPSS 1.6%

    A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead…

  10. 9.8CVE-2023-46308EPSS 0.9%

    In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.

  11. 6.5CVE-2023-26920EPSS 1.2%

    fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.

  12. 8.2CVE-2023-26158EPSS 0.8%

    All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is p…

  13. 7.1CVE-2023-6293EPSS 0.6%

    Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.

  14. 9.8CVE-2023-45827EPSS 1.4%

    Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in th…

  15. 9.6CVE-2023-1717EPSS 1.5%

    Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP c…

  16. 6.1CVE-2023-3965EPSS 0.4%

    The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…

  17. 6.1CVE-2023-3962EPSS 0.4%

    The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthen…

  18. 6.1CVE-2023-3933EPSS 0.4%

    The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for una…

  19. 7.8CVE-2023-45811EPSS 0.4%

    Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability e…

  20. 7.5CVE-2023-45282EPSS 1.2%

    In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.

  21. 9.8CVE-2023-38894EPSS 1.7%

    A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.

  22. 9.8CVE-2021-26505EPSS 1.1%

    Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.

  23. 7.5CVE-2023-26139EPSS 0.9%

    Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the…

  24. 9.8CVE-2023-3696EPSS 1.2%

    Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

  25. 9.8CVE-2023-36665EPSS 1.7%

    "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.proto…

  26. 9.8CVE-2023-26136EPSS 2.6%

    Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are…

  27. 9.8CVE-2023-26135EPSS 0.9%

    All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.

  28. 9.8CVE-2023-36475EPSS 3.2%

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoD…

  29. 9.8CVE-2023-26133EPSS 1.3%

    All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.

  30. 7.5CVE-2023-26132EPSS 1.1%

    Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.

  31. 9.8CVE-2023-2972EPSS 1.0%

    Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.

  32. 8.8CVE-2023-32305EPSS 0.7%

    aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missin…

  33. 6.1CVE-2023-2582EPSS 0.6%

    A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built with Strikingly. The vulnerability exists because of Strikingly JavaScript libra…

  34. 3.7CVE-2023-30857EPSS 0.5%

    @aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object…

  35. 9.8CVE-2023-30363EPSS 1.0%

    vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.

  36. 7.8CVE-2023-30533EPSS 1.0%

    SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.

  37. 10.0CVE-2023-26122EPSS 2.1%

    All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execut…

  38. 10.0CVE-2023-26121EPSS 1.1%

    All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.

  39. 5.3CVE-2023-0842EPSS 1.4%

    xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.

  40. 8.2CVE-2023-28427EPSS 1.2%

    matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potent…

  41. 8.2CVE-2023-28103EPSS 0.7%

    matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-…

  42. 5.3CVE-2022-36060EPSS 0.9%

    matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile cra…

  43. 5.3CVE-2022-36059EPSS 0.9%

    matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potent…

  44. 7.5CVE-2023-26113EPSS 1.2%

    Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.

  45. 7.5CVE-2023-26106EPSS 0.9%

    All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.

  46. 7.5CVE-2023-26105EPSS 1.3%

    All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.

  47. 8.2CVE-2023-26102EPSS 0.8%

    All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype

  48. 8.8CVE-2023-23917EPSS 1.0%

    A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affec…

  49. 6.1CVE-2022-3901EPSS 0.4%

    Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system.

  50. 9.8CVE-2021-4307EPSS 1.4%

    A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype a…