CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution), page 9

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

What the weakness is: CWE-1321 at MITRE. All weaknesses

1. 9.8CVE-2022-4742EPSS 1.1%2022-12-26

   A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototyp…

2. 9.8CVE-2021-4279EPSS 1.2%2022-12-25

   A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes (…

3. 9.8CVE-2020-36632EPSS 1.2%2022-12-25

   A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes …

4. 7.8CVE-2021-4278EPSS 0.4%2022-12-25

   A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Up…

5. 8.8CVE-2022-46175EPSS 9.7%2022-12-24

   JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict par…

6. 8.8CVE-2022-2200EPSS 24%2022-12-22

   If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunder…

7. 8.8CVE-2022-1802EPSS 28%2022-12-22

   If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox …

8. 8.8CVE-2022-1529EPSS 18%2022-12-22

   An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged par…

9. 8.8CVE-2021-4264EPSS 1.2%2022-12-21

   A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('proto…

10. 9.8CVE-2022-25904EPSS 0.9%2022-12-20

    All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variabl…

11. 9.8CVE-2020-36618EPSS 1.0%2022-12-19

    A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype p…

12. 9.8CVE-2021-4245EPSS 1.4%2022-12-15

    A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollu…

13. 7.5CVE-2022-24999EPSS 16%2022-11-26

    qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated re…

14. 9.8CVE-2022-41878EPSS 1.1%2022-11-10

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected …

15. 9.8CVE-2022-41879EPSS 1.0%2022-11-10

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototyp…

16. 9.8CVE-2022-39396EPSS 39%2022-11-10

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. An at…

17. 5.3CVE-2022-42743EPSS 0.7%2022-11-03

    deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be…

18. 5.3CVE-2022-41714EPSS 0.7%2022-11-03

    fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to …

19. 5.3CVE-2022-41713EPSS 0.8%2022-11-03

    deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the '__proto__' property to be edi…

20. 9.8CVE-2022-37623EPSS 1.5%2022-10-31

    Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.

21. 9.8CVE-2022-37621EPSS 1.4%2022-10-28

    Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.

22. 9.8CVE-2022-39357EPSS 1.4%2022-10-26

    Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin …

23. 9.8CVE-2022-29823EPSS 1.8%2022-10-26

    Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.

24. 9.8CVE-2022-37598EPSS 2.0%2022-10-20

    Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.

25. 9.8CVE-2022-37602EPSS 2.1%2022-10-14

    Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.

26. 9.8CVE-2022-37601EPSS 3.5%2022-10-12

    Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

27. 9.8CVE-2022-37614EPSS 1.6%2022-10-12

    Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js.

28. 9.8CVE-2022-37611EPSS 1.4%2022-10-12

    Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.

29. 9.8CVE-2022-37617EPSS 1.5%2022-10-11

    Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.

30. 9.8CVE-2022-37609EPSS 1.7%2022-10-11

    Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js.

31. 9.8CVE-2022-37616EPSS 2.1%2022-10-11

    A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this repor…

32. 6.1CVE-2022-21169EPSS 1.0%2022-09-26

    The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

33. 8.1CVE-2020-36604EPSS 1.2%2022-09-23

    hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

34. 9.8CVE-2022-37265EPSS 1.6%2022-09-20

    Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.

35. 9.8CVE-2022-37258EPSS 1.6%2022-09-16

    Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.

36. 9.8CVE-2022-37264EPSS 1.6%2022-09-15

    Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.

37. 9.8CVE-2022-37266EPSS 1.4%2022-09-15

    Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.

38. 9.8CVE-2022-37257EPSS 1.4%2022-09-15

    Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.

39. 8.0CVE-2022-2625EPSS 2.2%2022-08-18

    A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and…

40. 9.8CVE-2022-25907EPSS 1.9%2022-08-09

    The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.

41. 9.8CVE-2022-2564EPSS 31%2022-07-28

    Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

42. 9.8CVE-2021-23397EPSS 0.8%2022-07-25

    All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.

43. 9.8CVE-2021-23373EPSS 1.2%2022-07-25

    All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.

44. 9.8CVE-2020-28471EPSS 1.5%2022-07-25

    This affects the package properties-reader before 2.2.0.

45. 9.8CVE-2020-28462EPSS 0.9%2022-07-25

    This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the c…

46. 9.8CVE-2020-28461EPSS 1.2%2022-07-25

    This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the cont…

47. 9.8CVE-2020-28441EPSS 1.2%2022-07-25

    This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on th…

48. 7.8CVE-2020-7641EPSS 0.4%2022-07-17

    This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

49. 9.8CVE-2021-40663EPSS 1.8%2022-06-30

    deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

50. 9.8CVE-2022-31106EPSS 1.1%2022-06-28

    Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and …