Improperly Controlled Modification of Object Prototype Attributes
CWE-1321
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
We track 257 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
- Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
- Implementation: When handling untrusted objects, validating using a schema can be used.
- Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
- Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Latest Improperly Controlled Modification of Object Prototype Attributes vulnerabilities
- 8.5 High severity
trpc: Improperly Controlled Modification of Object Prototype Attributes
tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11.8.0, a A prototype pollution vulnerability exists in `@trpc/server`'s `formDataToObject` function, w
- 8.6 High severity
Vuetify: Improperly Controlled Modification of Object Prototype Attributes
The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html due to the internal 'mergeDeep' utility
- 9.8 Critical severity
elysia: Improperly Controlled Modification of Object Prototype Attributes
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schem
- 9.8 Critical severity
expr-eval: Improperly Controlled Modification of Object Prototype Attributes
npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
- 9.4 Critical severity
happy-dom: Improperly Controlled Modification of Object Prototype Attributes
In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can
- 8.3 High severity
sveltekit-superforms: Improperly Controlled Modification of Object Prototype Attributes
sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties int
- 7.5 High severity
algoliasearch-helper: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edg
- 7.5 High severity
Csvjson: Improperly Controlled Modification of Object Prototype Attributes
A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
- 7.5 High severity
Web3-core-method: Improperly Controlled Modification of Object Prototype Attributes
web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via su
- 7.5 High severity
Toggle-array: Improperly Controlled Modification of Object Prototype Attributes
toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objects. A Prototype Pollution vulnerability in the enable and disable function of toggle-array v1.0.1 and before allows at
- 7.5 High severity
Spmrc: Improperly Controlled Modification of Object Prototype Attributes
spmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc version 1.2.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing den
- 7.5 High severity
Sassdoc-extras: Improperly Controlled Modification of Object Prototype Attributes
A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
- 7.5 High severity
Rollbar: Improperly Controlled Modification of Object Prototype Attributes
rollbar is a package designed to effortlessly track and debug errors in JavaScript applications. This package includes advanced error tracking features and an intuitive interface to help you identify and fix issues more quickly. A Prototype Pollution vulnerabi
- 7.5 High severity
Mpregular: Improperly Controlled Modification of Object Prototype Attributes
mpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mp.addEventHandler function of mpregular version 0.2.0 and before allows attackers to inject properties on Object.prototyp
- 9.8 Critical severity
Magix-combine-ex: Improperly Controlled Modification of Object Prototype Attributes
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum conse
- 7.5 High severity
Messageformat: Improperly Controlled Modification of Object Prototype Attributes
The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested mess
- 9.8 Critical severity
Dagre-d3-es: Improperly Controlled Modification of Object Prototype Attributes
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exp
- 7.5 High severity
Web3-core-subscriptions: Improperly Controlled Modification of Object Prototype Attributes
The web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in the attachToObject function of web3-core-subscriptions version 1.10.4 and before allows attackers to inject properties on Object.prototype v
- 8.6 High severity
Csvtojson: Improperly Controlled Modification of Object Prototype Attributes
The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the
- 7.9 High severity
devalue: Improperly Controlled Modification of Object Prototype Attributes
Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects an
- 7.3 High severity
std: Improperly Controlled Modification of Object Prototype Attributes
@std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution (PP) vulnerability. This is because the library is m
- 8.8 High severity
content-security-policy-parser: Improperly Controlled Modification of Object Prototype Attributes
content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched
- 7.5 High severity
js-toml: Improperly Controlled Modification of Object Prototype Attributes
js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciou
- 7.0 High severity
sandboxjs: Improperly Controlled Modification of Object Prototype Attributes
A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain co
- 8.8 High severity
Linkify: Improperly Controlled Modification of Object Prototype Attributes
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.
- 9.8 Critical severity
billboard.js: Improperly Controlled Modification of Object Prototype Attributes
billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 8.8 High severity
docarray: Improperly Controlled Modification of Object Prototype Attributes
A vulnerability was found in docarray up to 0.40.1. It has been rated as critical. Affected by this issue is the function __getitem__ of the file /docarray/data/torch_dataset.py of the component Web API. The manipulation leads to improperly controlled modifica
- 9.8 Critical severity
Kibana: Improperly Controlled Modification of Object Prototype Attributes
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
- 8.8 High severity
Sverchok: Improperly Controlled Modification of Object Prototype Attributes
A vulnerability, which was classified as problematic, was found in nortikin Sverchok 1.3.0. Affected is the function SvSetPropNodeMK2 of the file sverchok/nodes/object_nodes/getsetprop_mk2.py of the component Set Property Mk2 Node. The manipulation leads to im
- 7.3 High severity
expand-object: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sen
- 7.5 High severity
Redoc: Improperly Controlled Modification of Object Prototype Attributes
A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- 9.8 Critical severity
Unflatto: Improperly Controlled Modification of Object Prototype Attributes
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 9.8 Critical severity
Depath: Improperly Controlled Modification of Object Prototype Attributes
janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecti
- 8.9 High severity
vue-i18n: Improperly Controlled Modification of Object Prototype Attributes
Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the entry function: handleFlatJson. An attacker can supply a payload with Object.prototype setter to intr
- 9.9 Critical severity
Kibana: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2
- 7.2 High severity
Progress® Telerik® Kendo UI for Vue: Improperly Controlled Modification of Object Prototype Attributes
In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.
- 7.2 High severity
Telerik KendoReact: Improperly Controlled Modification of Object Prototype Attributes
In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.
- 9.8 Critical severity
Partners: Improperly Controlled Modification of Object Prototype Attributes
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection.This issue affects Partners: from n/a through <= 0.2.0.
- 7.5 High severity
bun: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. **Note:** This issue relates to the widely k
- 8.4 High severity
Convict: Improperly Controlled Modification of Object Prototype Attributes
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have i