Common Weakness Enumeration

CWE-1321

Allowed

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Abstraction: Variant · Status: Incomplete

API response cwe.mitre.org

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

778 vulnerabilities reference this CWE, most recent first.

GHSA-VPGW-FFH3-648H

Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-22 20:20
VLAI
Summary
Prototype Pollution in fullpage.js
Details

fullPage utils are available to developers using window.fp_utils. They can use these utils for their own use-case (other than fullPage) as well. However, one of the utils deepExtend is vulnerable to Prototype Pollution vulnerability.

Javascript is "prototype" language which means when a new "object" is created, it carries the predefined properties and methods of an "object" with itself like toString, constructor etc. By using prototype-pollution vulnerability, an attacker can overwrite/create the property of that "object" type. If the victim developer has used that property anywhere in the code, then it will have severe effect on the application.

Severity
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fullpage.js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-1295"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-22T20:20:05Z",
    "nvd_published_at": "2022-04-11T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "fullPage utils are available to developers using window.fp_utils. They can use these utils for their own use-case (other than fullPage) as well. However, one of the utils deepExtend is vulnerable to Prototype Pollution vulnerability.\n\nJavascript is \"prototype\" language which means when a new \"object\" is created, it carries the predefined properties and methods of an \"object\" with itself like toString, constructor etc. By using prototype-pollution vulnerability, an attacker can overwrite/create the property of that \"object\" type. If the victim developer has used that property anywhere in the code, then it will have severe effect on the application.",
  "id": "GHSA-vpgw-ffh3-648h",
  "modified": "2022-04-22T20:20:55Z",
  "published": "2022-04-12T00:00:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1295"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alvarotrigo/fullpage.js/commit/bf62492a22e5d296e63c3ed918a42fc5645a0d48"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/alvarotrigo/fullpage.js"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/3b9d450c-24ac-4037-b04d-4d4dafbf593a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in fullpage.js"
}

GHSA-VPMM-X3FM-QR5C

Vulnerability from github – Published: 2026-06-18 13:05 – Updated: 2026-06-18 13:05
VLAI
Summary
jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()
Details

Summary

Jodit.modules.Helpers.set(chain, value, obj) walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype (prototype pollution).

Affected

  • Package: jodit (npm)
  • Versions: < 4.12.26
  • Public API: Jodit.modules.Helpers.set(chain, value, obj)

Proof of Concept

const { Jodit } = require('jodit');
delete Object.prototype.polluted;
Jodit.modules.Helpers.set('__proto__.polluted', 'yes', {});
console.log(({}).polluted); // "yes" (before the fix)
delete Object.prototype.polluted;

Impact

Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable to prototype pollution (CWE-1321): unexpected property injection, logic bypass, denial of service, or secondary security issues.

Patch

Fixed in 4.12.26 by rejecting any chain whose segments include __proto__, constructor, or prototype, reusing the same guard introduced for Jodit.configure() in 4.12.18.

Credit

Responsibly reported by Junming Wu.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "jodit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.12.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55886"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T13:05:01Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n`Jodit.modules.Helpers.set(chain, value, obj)` walks the dot-separated `chain`, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) `__proto__`, `constructor`, or `prototype` lets the final assignment reach and mutate `Object.prototype` (prototype pollution).\n\n### Affected\n- Package: `jodit` (npm)\n- Versions: `\u003c 4.12.26`\n- Public API: `Jodit.modules.Helpers.set(chain, value, obj)`\n\n### Proof of Concept\n```js\nconst { Jodit } = require(\u0027jodit\u0027);\ndelete Object.prototype.polluted;\nJodit.modules.Helpers.set(\u0027__proto__.polluted\u0027, \u0027yes\u0027, {});\nconsole.log(({}).polluted); // \"yes\" (before the fix)\ndelete Object.prototype.polluted;\n```\n\n### Impact\nApplications that pass a user-controlled or partially user-controlled key path into `Jodit.modules.Helpers.set()` could be vulnerable to prototype pollution (CWE-1321): unexpected property injection, logic bypass, denial of service, or secondary security issues.\n\n### Patch\nFixed in 4.12.26 by rejecting any `chain` whose segments include `__proto__`, `constructor`, or `prototype`, reusing the same guard introduced for `Jodit.configure()` in 4.12.18.\n\n### Credit\nResponsibly reported by Junming Wu.",
  "id": "GHSA-vpmm-x3fm-qr5c",
  "modified": "2026-06-18T13:05:01Z",
  "published": "2026-06-18T13:05:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xdan/jodit"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()"
}

GHSA-VQ33-26PR-R4H6

Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2024-04-01 22:02
VLAI
Summary
flattenizer vulnerable to prototype pollution
Details

Overview

Prototype pollution vulnerability in ‘flattenizer’ versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.

Details

The NPM module 'flattenizer' can be abused by Prototype Pollution vulnerability since the function 'unflatten()' did not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.

PoC Details

There is no validation before assigning the property to check whether the assigned argument is the Object's own property or not, the property polluted will be directly be assigned thereby polluting the Object prototype. Later in the code, if there is a check to validate polluted the valued would be substituted as "true" as it had been polluted.

var flattenizer = require("flattenizer")
flattenizer.unflatten({'__proto__.polluted': true});
console.log(polluted);
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.5"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flattenizer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.5"
            },
            {
              "fixed": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-28279"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-01T22:02:50Z",
    "nvd_published_at": "2020-12-29T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Overview\nPrototype pollution vulnerability in \u2018flattenizer\u2019 versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.\n\n### Details\nThe NPM module \u0027flattenizer\u0027 can be abused by Prototype Pollution vulnerability since the function \u0027unflatten()\u0027 did not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to Denial of Service or potentially Remote code execution.\n\n### PoC Details\nThere is no validation before assigning the property to check whether the assigned argument is the Object\u0027s own property or not, the property `polluted` will be directly be assigned thereby polluting the Object prototype. Later in the code, if there is a check to validate `polluted` the valued would be substituted as \"true\" as it had been polluted.\n\n```js\nvar flattenizer = require(\"flattenizer\")\nflattenizer.unflatten({\u0027__proto__.polluted\u0027: true});\nconsole.log(polluted);\n```",
  "id": "GHSA-vq33-26pr-r4h6",
  "modified": "2024-04-01T22:02:50Z",
  "published": "2022-05-24T17:37:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28279"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sahellebusch/flattenizer/pull/13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sahellebusch/flattenizer/commit/3c6a6353df7c8879e931973b81a49a47f6c2b399"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20210104205035/https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28279"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "flattenizer vulnerable to prototype pollution"
}

GHSA-VQQW-FR4W-V889

Vulnerability from github – Published: 2024-12-18 12:30 – Updated: 2026-04-01 18:32
VLAI
Details

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mighty Digital Partners allows Object Injection.This issue affects Partners: from n/a through 0.2.0.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-56059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-18T12:15:12Z",
    "severity": "CRITICAL"
  },
  "details": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) vulnerability in Mighty Digital Partners allows Object Injection.This issue affects Partners: from n/a through 0.2.0.",
  "id": "GHSA-vqqw-fr4w-v889",
  "modified": "2026-04-01T18:32:52Z",
  "published": "2024-12-18T12:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56059"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/partners/vulnerability/wordpress-partners-plugin-0-2-0-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VR5M-3H59-7JCP

Vulnerability from github – Published: 2021-07-01 17:01 – Updated: 2022-05-26 19:57
VLAI
Summary
Prototype Pollution in think-helper
Details

Impact

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Patches

think-helper@1.1.3 patched it, anyone used think-helper should upgrade to >=1.1.3 version.

References

https://cwe.mitre.org/data/definitions/1321.html

For more information

If you have any questions or comments about this advisory: * Open an issue in thinkjs/thinkjs * Email us at i@imnerd.org

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "think-helper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-32736"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-30T17:40:38Z",
    "nvd_published_at": "2021-06-30T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.\n\n### Patches\n\n`think-helper@1.1.3` patched it, anyone used `think-helper` should upgrade to `\u003e=1.1.3` version.\n\n### References\n\nhttps://cwe.mitre.org/data/definitions/1321.html\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [thinkjs/thinkjs](https://github.com/thinkjs/thinkjs)\n* Email us at [i@imnerd.org](mailto:i@imnerd.org)\n",
  "id": "GHSA-vr5m-3h59-7jcp",
  "modified": "2022-05-26T19:57:25Z",
  "published": "2021-07-01T17:01:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32736"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thinkjs/think-helper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in think-helper"
}

GHSA-VRFH-PH2R-GXR9

Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-02-06 15:32
VLAI
Details

A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-57076"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-05T22:15:31Z",
    "severity": "HIGH"
  },
  "details": "A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.",
  "id": "GHSA-vrfh-ph2r-gxr9",
  "modified": "2025-02-06T15:32:52Z",
  "published": "2025-02-06T06:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57076"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/tariqhawis/c432b93ee7d967c2e65bc1bf39241664"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VRR3-5R3V-7XFW

Vulnerability from github – Published: 2021-05-17 21:00 – Updated: 2023-09-13 19:52
VLAI
Summary
Improperly Controlled Modification of Dynamically-Determined Object Attributes in casperjs
Details

Overview

casperjs is a navigation scripting & testing utility for PhantomJS and SlimerJS.

Affected versions of this package are vulnerable to Prototype Pollution via the mergeObjects utility function.

PoC

var payload = JSON.parse('{"__proto__": {"a": "pwned"}}');
mergeObjects({}, payload);
console.log({}.a); // prints "pwned"
Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "casperjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-7679"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-11T22:26:54Z",
    "nvd_published_at": "2020-06-19T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Overview\ncasperjs is a navigation scripting \u0026 testing utility for PhantomJS and SlimerJS.\n\nAffected versions of this package are vulnerable to Prototype Pollution via the mergeObjects utility function.\n\n### PoC\n```js\nvar payload = JSON.parse(\u0027{\"__proto__\": {\"a\": \"pwned\"}}\u0027);\nmergeObjects({}, payload);\nconsole.log({}.a); // prints \"pwned\"\n```",
  "id": "GHSA-vrr3-5r3v-7xfw",
  "modified": "2023-09-13T19:52:14Z",
  "published": "2021-05-17T21:00:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7679"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/casperjs/casperjs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/casperjs/casperjs/blob/master/modules/utils.js%23L680"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-572804"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-CASPERJS-572803"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improperly Controlled Modification of Dynamically-Determined Object Attributes in casperjs"
}

GHSA-VRW9-G62V-7FMF

Vulnerability from github – Published: 2025-09-24 18:30 – Updated: 2026-01-27 21:06
VLAI
Summary
CSVTOJSON has a prototype pollution vulnerability
Details

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using proto syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "csvtojson"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-57350"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-24T20:10:59Z",
    "nvd_published_at": "2025-09-24T18:15:41Z",
    "severity": "MODERATE"
  },
  "details": "The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.",
  "id": "GHSA-vrw9-g62v-7fmf",
  "modified": "2026-01-27T21:06:02Z",
  "published": "2025-09-24T18:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57350"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Keyang/node-csvtojson/issues/498"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Keyang/node-csvtojson/issues/502"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Keyang/node-csvtojson/commit/4caeebd13b67be63282a7bbed3ca0cf9813f4bfc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Keyang/node-csvtojson"
    },
    {
      "type": "WEB",
      "url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57350"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-CSVTOJSON-13109616"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "CSVTOJSON has a prototype pollution vulnerability"
}

GHSA-VVV8-XW5F-3F88

Vulnerability from github – Published: 2022-06-18 00:00 – Updated: 2022-06-20 22:33
VLAI
Summary
Prototype Pollution in mout
Details

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability. Note: This vulnerability derives from an incomplete fix of CVE-2020-7792.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.2.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "mout"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-21213"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-20T22:33:58Z",
    "nvd_published_at": "2022-06-17T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "This affects all versions of package mout. The deepFillIn function can be used to \u0027fill missing properties recursively\u0027, while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7792](https://security.snyk.io/vuln/SNYK-JS-MOUT-1014544).",
  "id": "GHSA-vvv8-xw5f-3f88",
  "modified": "2022-06-20T22:33:58Z",
  "published": "2022-06-18T00:00:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21213"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mout/mout/pull/279"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mout/mout/commit/17ffdc2a96417a63a0147156dc045e90d0d14c64"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mout/mout"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mout/mout/blob/master/src/object/deepFillIn.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mout/mout/blob/master/src/object/deepMixIn.js"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-MOUT-2342654"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in mout"
}

GHSA-VWHQ-PM3R-FJM9

Vulnerability from github – Published: 2022-09-16 00:00 – Updated: 2022-09-21 21:08
VLAI
Summary
steal vulnerable to Prototype Pollution via key variable in babel.js
Details

Prototype pollution vulnerability in function extend in babel.js in stealjs steal via the key variable in babel.js.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "steal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-37266"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-21T21:08:01Z",
    "nvd_published_at": "2022-09-15T13:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Prototype pollution vulnerability in function extend in babel.js in stealjs steal via the key variable in babel.js.",
  "id": "GHSA-vwhq-pm3r-fjm9",
  "modified": "2022-09-21T21:08:01Z",
  "published": "2022-09-16T00:00:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37266"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stealjs/steal/issues/1535"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/stealjs/steal"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L29165"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L29169"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "steal vulnerable to Prototype Pollution via key variable in babel.js"
}
Mitigation
Implementation

By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

Mitigation
Architecture and Design

By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Mitigation
Implementation

Strategy: Input Validation

When handling untrusted objects, validating using a schema can be used.

Mitigation
Implementation

By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.

Mitigation
Implementation

Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list