CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
780 vulnerabilities reference this CWE, most recent first.
GHSA-MXRG-77HM-89HV
Vulnerability from github – Published: 2026-03-26 16:41 – Updated: 2026-03-26 16:41Impact
An authenticated user with permission to create or modify workflows could exploit a prototype pollution vulnerability in the GSuiteAdmin node. By supplying a crafted parameter as part of node configuration, an attacker could write attacker-controlled values onto Object.prototype. An attacker could use this prototype pollution to achieve remote code execution on the n8n instance.
Patches
The issue has been fixed in n8n versions 2.14.1, 2.13.3, and 1.123.27. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Disable the XML node by adding n8n-nodes-base.xml to the NODES_EXCLUDE environment variable.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.14.0"
},
{
"fixed": "2.14.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.14.0"
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-rc.0"
},
{
"fixed": "2.13.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.123.27"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33696"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-26T16:41:01Z",
"nvd_published_at": "2026-03-25T18:16:32Z",
"severity": "CRITICAL"
},
"details": "## Impact\nAn authenticated user with permission to create or modify workflows could exploit a prototype pollution vulnerability in the GSuiteAdmin node. By supplying a crafted parameter as part of node configuration, an attacker could write attacker-controlled values onto `Object.prototype`. An attacker could use this prototype pollution to achieve remote code execution on the n8n instance.\n\n## Patches\nThe issue has been fixed in n8n versions 2.14.1, 2.13.3, and 1.123.27. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Disable the XML node by adding `n8n-nodes-base.xml` to the `NODES_EXCLUDE` environment variable.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
"id": "GHSA-mxrg-77hm-89hv",
"modified": "2026-03-26T16:41:01Z",
"published": "2026-03-26T16:41:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-mxrg-77hm-89hv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33696"
},
{
"type": "PACKAGE",
"url": "https://github.com/n8n-io/n8n"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE"
}
GHSA-P23C-P8W2-WW5V
Vulnerability from github – Published: 2022-06-18 00:00 – Updated: 2022-06-20 22:27All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of CVE-2020-7600.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "querymen"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25871"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-20T22:27:37Z",
"nvd_published_at": "2022-06-17T20:15:00Z",
"severity": "MODERATE"
},
"details": "All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867).",
"id": "GHSA-p23c-p8w2-ww5v",
"modified": "2022-06-20T22:27:37Z",
"published": "2022-06-18T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25871"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-QUERYMEN-2391488"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in querymen"
}
GHSA-P2FH-2H23-6GRG
Vulnerability from github – Published: 2023-05-30 12:30 – Updated: 2023-06-02 17:11Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@antfu/utils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-2972"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-02T17:11:18Z",
"nvd_published_at": "2023-05-30T11:15:09Z",
"severity": "MODERATE"
},
"details": "Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.",
"id": "GHSA-p2fh-2h23-6grg",
"modified": "2023-06-02T17:11:18Z",
"published": "2023-05-30T12:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2972"
},
{
"type": "WEB",
"url": "https://github.com/antfu/utils/commit/7f8b16c6181c988bdb96613fbb2533b345f68682"
},
{
"type": "PACKAGE",
"url": "https://github.com/antfu/utils"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/009f1cd9-401c-49a7-bd08-be35cff6faef"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "antfu/utils vulnerable to prototype pollution"
}
GHSA-P2PH-7G93-HW3M
Vulnerability from github – Published: 2025-03-07 15:58 – Updated: 2025-03-07 19:16Vulnerability type: Prototype Pollution
Vulnerability Location(s):
# v9.1
node_modules/@intlify/message-resolver/index.js
# v9.2 or later
node_modules/@intlify/vue-i18n-core/index.js
Description:
The latest version of @intlify/message-resolver (9.1) and @intlify/vue-i18n-core (9.2 or later), (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) handleFlatJson. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.
Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.
PoC:
// install the package with the latest version
~$ npm install @intlify/message-resolver@9.1.10
// run the script mentioned below
~$ node poc.js
//The expected output (if the code still vulnerable) is below.
// Note that the output may slightly differs from function to another.
Before Attack: {}
After Attack: {"pollutedKey":123}
// poc.js
(async () => {
const lib = await import('@intlify/message-resolver');
var someObj = {}
console.log("Before Attack: ", JSON.stringify({}.__proto__));
try {
// for multiple functions, uncomment only one for each execution.
lib.handleFlatJson ({ "__proto__.pollutedKey": "pollutedValue" })
} catch (e) { }
console.log("After Attack: ", JSON.stringify({}.__proto__));
delete Object.prototype.pollutedKey;
})();
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@intlify/message-resolver"
},
"ranges": [
{
"events": [
{
"introduced": "9.1.0"
},
{
"fixed": "9.1.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@intlify/vue-i18n-core"
},
"ranges": [
{
"events": [
{
"introduced": "9.2.0"
},
{
"fixed": "9.14.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "petite-vue-i18n"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "vue-i18n"
},
"ranges": [
{
"events": [
{
"introduced": "9.1.0"
},
{
"fixed": "9.14.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@intlify/core-base"
},
"ranges": [
{
"events": [
{
"introduced": "9.1.0"
},
{
"fixed": "9.1.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@intlify/core"
},
"ranges": [
{
"events": [
{
"introduced": "9.1.0"
},
{
"fixed": "9.1.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c 10.0.6"
},
"package": {
"ecosystem": "npm",
"name": "@intlify/vue-i18n-core"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0-alpha.1"
},
{
"fixed": "11.1.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@intlify/vue-i18n-core"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-beta.0"
},
{
"fixed": "11.1.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "petite-vue-i18n"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-beta.0"
},
{
"fixed": "11.1.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "vue-i18n"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0-alpha.1"
},
{
"fixed": "10.0.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "vue-i18n"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-beta.0"
},
{
"fixed": "11.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-27597"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-07T15:58:24Z",
"nvd_published_at": "2025-03-07T16:15:39Z",
"severity": "HIGH"
},
"details": "**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application\u0027s context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulnerable) is below. \n// Note that the output may slightly differs from function to another.\nBefore Attack: {}\nAfter Attack: {\"pollutedKey\":123}\n```\n\n```js\n// poc.js\n(async () =\u003e {\n const lib = await import(\u0027@intlify/message-resolver\u0027);\n var someObj = {}\n console.log(\"Before Attack: \", JSON.stringify({}.__proto__));\n try {\n // for multiple functions, uncomment only one for each execution.\n lib.handleFlatJson ({ \"__proto__.pollutedKey\": \"pollutedValue\" })\n } catch (e) { }\n console.log(\"After Attack: \", JSON.stringify({}.__proto__));\n delete Object.prototype.pollutedKey;\n})();\n```",
"id": "GHSA-p2ph-7g93-hw3m",
"modified": "2025-03-07T19:16:45Z",
"published": "2025-03-07T15:58:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-p2ph-7g93-hw3m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27597"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/commit/4bb6eacda7fc2cde5687549afa0efb27ca40862a"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/commit/d21e06a7440eed8ada7f522b22fcf830b98d3a53"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/commit/fbda9988d3ddd3a1a21740d506d2c183d6b6e36a"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/commit/feaf13fcff427f2cb1d5ec8076e639506ba28f9e"
},
{
"type": "PACKAGE",
"url": "https://github.com/intlify/vue-i18n"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/releases/tag/v10.0.6"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/releases/tag/v11.1.2"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/releases/tag/v9.14.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Vue I18n Allows Prototype Pollution in `handleFlatJson`"
}
GHSA-P33M-7W7F-GMJ8
Vulnerability from github – Published: 2021-12-10 20:05 – Updated: 2021-07-29 16:41fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "fun-map"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7644"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-25T20:37:47Z",
"nvd_published_at": "2020-04-28T19:15:00Z",
"severity": "HIGH"
},
"details": "fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of \u0027Object.prototype\u0027 using a \u0027__proto__\u0027 payload.",
"id": "GHSA-p33m-7w7f-gmj8",
"modified": "2021-07-29T16:41:29Z",
"published": "2021-12-10T20:05:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7644"
},
{
"type": "WEB",
"url": "https://github.com/nathan7/fun-map/blob/master/index.js#L137,"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-FUNMAP-564436"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncontrolled Resource Consumption in fun-map"
}
GHSA-P3HC-FV2J-RP68
Vulnerability from github – Published: 2021-05-10 15:36 – Updated: 2021-05-07 17:34Versions of the package swiper before 6.5.1 are susceptible to prototype pollution.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "swiper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23370"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-07T17:34:38Z",
"nvd_published_at": "2021-04-12T14:15:00Z",
"severity": "CRITICAL"
},
"details": "Versions of the package swiper before 6.5.1 are susceptible to prototype pollution.",
"id": "GHSA-p3hc-fv2j-rp68",
"modified": "2021-05-07T17:34:38Z",
"published": "2021-05-10T15:36:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23370"
},
{
"type": "WEB",
"url": "https://github.com/nolimits4web/Swiper/commit/ec358deab79a8cd2529465f07a0ead5dbcc264ad"
},
{
"type": "WEB",
"url": "https://github.com/nolimits4web/swiper/commit/9dad2739b7474f383474773d5ab898a0c29ac178"
},
{
"type": "WEB",
"url": "https://github.com/nolimits4web/swiper/blob/master/CHANGELOG.md#651-2021-03-29"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1244698"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1244699"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBNOLIMITS4WEB-1244697"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1244696"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-SWIPER-1088062"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in swiper"
}
GHSA-P3PG-64PV-V7JG
Vulnerability from github – Published: 2022-05-03 00:00 – Updated: 2022-05-20 20:48All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "jsgui-lang-essentials"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.4.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25301"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-20T20:48:37Z",
"nvd_published_at": "2022-05-01T17:15:00Z",
"severity": "HIGH"
},
"details": "All versions of package `jsgui-lang-essentials` are vulnerable to Prototype Pollution due to allowing all `Object` attributes to be altered, including their magical attributes such as `proto`, `constructor` and `prototype`.",
"id": "GHSA-p3pg-64pv-v7jg",
"modified": "2022-05-20T20:48:37Z",
"published": "2022-05-03T00:00:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25301"
},
{
"type": "WEB",
"url": "https://github.com/metabench/jsgui-lang-essentials/issues/1"
},
{
"type": "PACKAGE",
"url": "https://github.com/metabench/jsgui-lang-essentials"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-JSGUILANGESSENTIALS-2316897"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in jsgui-lang-essentials"
}
GHSA-P3VF-V8QC-CWCR
Vulnerability from github – Published: 2024-10-31 14:23 – Updated: 2025-11-03 21:31dompurify was vulnerable to prototype pollution
Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "dompurify"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-48910"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-31T14:23:34Z",
"nvd_published_at": "2024-10-31T15:15:15Z",
"severity": "CRITICAL"
},
"details": "dompurify was vulnerable to prototype pollution\n\nFixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc",
"id": "GHSA-p3vf-v8qc-cwcr",
"modified": "2025-11-03T21:31:29Z",
"published": "2024-10-31T14:23:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48910"
},
{
"type": "WEB",
"url": "https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc"
},
{
"type": "PACKAGE",
"url": "https://github.com/cure53/DOMPurify"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "DOMPurify vulnerable to tampering by prototype polution"
}
GHSA-P495-JXH2-WRFG
Vulnerability from github – Published: 2022-12-15 21:30 – Updated: 2022-12-20 18:53A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The exploit has been disclosed to the public and may be used. The name of the patch is c006ce9faa43d31edb34924f1df7b79c137096cf. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215883.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "rfc6902"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-4245"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-74"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-15T23:29:47Z",
"nvd_published_at": "2022-12-15T20:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027). The exploit has been disclosed to the public and may be used. The name of the patch is c006ce9faa43d31edb34924f1df7b79c137096cf. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215883.",
"id": "GHSA-p495-jxh2-wrfg",
"modified": "2022-12-20T18:53:51Z",
"published": "2022-12-15T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4245"
},
{
"type": "WEB",
"url": "https://github.com/chbrown/rfc6902/issues/84"
},
{
"type": "WEB",
"url": "https://github.com/chbrown/rfc6902/pull/76"
},
{
"type": "WEB",
"url": "https://github.com/chbrown/rfc6902/commit/c006ce9faa43d31edb34924f1df7b79c137096cf"
},
{
"type": "PACKAGE",
"url": "https://github.com/chbrown/rfc6902"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.215883"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "npm package rfc6902 vulnerable to Prototype Pollution"
}
GHSA-P5G9-RJCF-95VJ
Vulnerability from github – Published: 2022-11-04 12:00 – Updated: 2022-11-08 14:49fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the __proto__ property to be edited.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "fastest-json-copy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-41714"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-08T14:49:19Z",
"nvd_published_at": "2022-11-03T20:15:00Z",
"severity": "MODERATE"
},
"details": "fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the `__proto__` property to be edited.",
"id": "GHSA-p5g9-rjcf-95vj",
"modified": "2022-11-08T14:49:19Z",
"published": "2022-11-04T12:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41714"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/guetta"
},
{
"type": "WEB",
"url": "https://github.com/streamich/fastest-json-copy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "fastest-json-copy vulnerable to Prototype Pollution"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.