Improperly Controlled Modification of Object Prototype Attributes
CWE-1321
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
We track 257 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
- Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
- Implementation: When handling untrusted objects, validating using a schema can be used.
- Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
- Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Latest Improperly Controlled Modification of Object Prototype Attributes vulnerabilities
- 9.8 Critical severity
tough-cookie: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
- 9.8 Critical severity
parse-server: Improperly Controlled Modification of Object Prototype Attributes
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patc
- 7.5 High severity
dottie: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.
- 8.8 High severity
aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation…
aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers o
- 7.8 High severity
Sheetjs: Improperly Controlled Modification of Object Prototype Attributes
SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.
- 10.0 Critical severity
safe-eval: Improperly Controlled Modification of Object Prototype Attributes
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution ("RCE"). **Vulner
- 10.0 Critical severity
safe-eval: Improperly Controlled Modification of Object Prototype Attributes
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.
- 8.2 High severity
matrix-js-sdk: Improperly Controlled Modification of Object Prototype Attributes
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the c
- 8.2 High severity
matrix-react-sdk: Improperly Controlled Modification of Object Prototype Attributes
matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionali
- 7.5 High severity
collection.js: Improperly Controlled Modification of Object Prototype Attributes
Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.
- 8.2 High severity
rangy: Improperly Controlled Modification of Object Prototype Attributes
All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype
- 8.8 High severity
Rocket.chat: Improperly Controlled Modification of Object Prototype Attributes
A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastru
- 9.8 Critical severity
json-pointer: Improperly Controlled Modification of Object Prototype Attributes
A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('protot
- 8.8 High severity
json5: Improperly Controlled Modification of Object Prototype Attributes
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `_
- 8.8 High severity
Firefox: Improperly Controlled Modification of Object Prototype Attributes
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thund
- 8.8 High severity
Firefox ESR: Improperly Controlled Modification of Object Prototype Attributes
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox
- 8.8 High severity
Firefox ESR: Improperly Controlled Modification of Object Prototype Attributes
An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vul
- 9.8 Critical severity
safe-eval: Improperly Controlled Modification of Object Prototype Attributes
All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacke
- 7.5 High severity
Qs: Improperly Controlled Modification of Object Prototype Attributes
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pla
- 9.8 Critical severity
parse-server: Improperly Controlled Modification of Object Prototype Attributes
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhoo
- 9.8 Critical severity
parse-server: Improperly Controlled Modification of Object Prototype Attributes
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass
- 9.8 Critical severity
parse-server: Improperly Controlled Modification of Object Prototype Attributes
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. An attacker can use this p
- 9.8 Critical severity
Browserify-shim: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.
- 9.8 Critical severity
Browserify-shim: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.
- 9.8 Critical severity
winter: Improperly Controlled Modification of Object Prototype Attributes
Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branc
- 9.8 Critical severity
Feathers-Sequalize: Improperly Controlled Modification of Object Prototype Attributes
Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.
- 9.8 Critical severity
Uglifyjs: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
- 9.8 Critical severity
Loader-utils: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
- 9.8 Critical severity
Mockery: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js.
- 9.8 Critical severity
Browserify-shim: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.
- 9.8 Critical severity
Xmldom: Improperly Controlled Modification of Object Prototype Attributes
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; howeve
- 9.8 Critical severity
Steal: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.
- 8.0 High severity
postgresql: Improperly Controlled Modification of Object Prototype Attributes
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure
- 9.8 Critical severity
underscore.deep: Improperly Controlled Modification of Object Prototype Attributes
Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to `deepFromF
- 9.8 Critical severity
deep-get-set: Improperly Controlled Modification of Object Prototype Attributes
All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7715](https://security.snyk.io/vuln/SNYK-JS-DEEPGETSET-598666)
- 7.5 High severity
querymen: Improperly Controlled Modification of Object Prototype Attributes
All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600
- 7.5 High severity
mout: Improperly Controlled Modification of Object Prototype Attributes
This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to
- 7.5 High severity
protobufjs: Improperly Controlled Modification of Object Prototype Attributes
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or
- 7.5 High severity
sds: Improperly Controlled Modification of Object Prototype Attributes
This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-7618](h
- 9.8 Critical severity
convict: Improperly Controlled Modification of Object Prototype Attributes
This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies on