Improperly Controlled Modification of Object Prototype Attributes
CWE-1321
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
We track 257 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
- Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
- Implementation: When handling untrusted objects, validating using a schema can be used.
- Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
- Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Latest Improperly Controlled Modification of Object Prototype Attributes vulnerabilities
- 9.8 Critical severity
Quick Learn: Improperly Controlled Modification of Object Prototype Attributes
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Rajesh Thanoch Quick Learn quick-learn allows Object Injection.This issue affects Quick Learn: from n/a through <= 1.0.1.
- 9.8 Critical severity
DOMPurify: Improperly Controlled Modification of Object Prototype Attributes
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
- 8.2 High severity
uplot: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.
- 8.2 High severity
dset: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property __proto__,
- 7.2 High severity
Kibana: Improperly Controlled Modification of Object Prototype Attributes
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary co
- 9.8 Critical severity
bunt: Improperly Controlled Modification of Object Prototype Attributes
izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 9.8 Critical severity
mini-deep-assign: Improperly Controlled Modification of Object Prototype Attributes
Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the _assign() method at (/lib/index.js:91)
- 9.8 Critical severity
strategyen: Improperly Controlled Modification of Object Prototype Attributes
ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 9.8 Critical severity
redoc: Improperly Controlled Modification of Object Prototype Attributes
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects.
- 9.8 Critical severity
snapstate: Improperly Controlled Modification of Object Prototype Attributes
chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 9.8 Critical severity
deep-merge: Improperly Controlled Modification of Object Prototype Attributes
Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.
- 9.8 Critical severity
json-override: Improperly Controlled Modification of Object Prototype Attributes
Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property.
- 9.8 Critical severity
form-manager: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and Object.setObjectValue.
- 7.2 High severity
HPE Aruba Networking EdgeConnect SD-WAN: Improperly Controlled Modification of Object Prototype Attributes
A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow
- 8.8 High severity
HPE Aruba Networking EdgeConnect SD-WAN…: Improperly Controlled Modification of Object Prototype Attributes
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to
- 8.1 High severity
utils: Improperly Controlled Modification of Object Prototype Attributes
che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 9.8 Critical severity
utils: Improperly Controlled Modification of Object Prototype Attributes
ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 9.8 Critical severity
2o3t-utility: Improperly Controlled Modification of Object Prototype Attributes
2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 10.0 Critical severity
fast-loops: Improperly Controlled Modification of Object Prototype Attributes
robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 7.3 High severity
common: Improperly Controlled Modification of Object Prototype Attributes
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 10.0 Critical severity
requirejs: Improperly Controlled Modification of Object Prototype Attributes
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 9.8 Critical severity
ag-grid-enterprise: Improperly Controlled Modification of Object Prototype Attributes
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary pro
- 7.3 High severity
common: Improperly Controlled Modification of Object Prototype Attributes
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 8.8 High severity
frappejs: Improperly Controlled Modification of Object Prototype Attributes
airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 8.8 High severity
patch-into: Improperly Controlled Modification of Object Prototype Attributes
akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- 9.8 Critical severity
obx: Improperly Controlled Modification of Object Prototype Attributes
almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.
- 8.2 High severity
mysql2: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
- 8.1 High severity
json-schema-ref-parser: Improperly Controlled Modification of Object Prototype Attributes
A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle()`, `parse()`, `resolve()`, `dereference() functions.
- 8.8 High severity
bit-loader: Improperly Controlled Modification of Object Prototype Attributes
A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argument in index.js.
- 8.6 High severity
conform: Improperly Controlled Modification of Object Prototype Attributes
Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollutio
- 9.8 Critical severity
nora-firebase-common: Improperly Controlled Modification of Object Prototype Attributes
An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method.
- 7.5 High severity
web3-utils: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of th
- 9.8 Critical severity
jsonata: Improperly Controlled Modification of Object Prototype Attributes
JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial
- 7.5 High severity
QTS: Improperly Controlled Modification of Object Prototype Attributes
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a net
- 8.2 High severity
mockjs: Improperly Controlled Modification of Object Prototype Attributes
All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create att
- 9.8 Critical severity
dot-diver: Improperly Controlled Modification of Object Prototype Attributes
Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` functio
- 9.6 Critical severity
Bitrix24: Improper Neutralization of Input During Web Page Generation
Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if
- 7.8 High severity
synchrony: Improperly Controlled Modification of Object Prototype Attributes
Synchrony deobfuscator is a javascript cleaner & deobfuscator. A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralM
- 7.5 High severity
underscore-keypath: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments l
- 9.8 Critical severity
Protobufjs: Improperly Controlled Modification of Object Prototype Attributes
"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and ov