Improperly Controlled Modification of Object Prototype Attributes
CWE-1321
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
We track 257 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
- Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
- Implementation: When handling untrusted objects, validating using a schema can be used.
- Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
- Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Latest Improperly Controlled Modification of Object Prototype Attributes vulnerabilities
- 7.5 High severity
bignum: Improperly Controlled Modification of Object Prototype Attributes
All versions of package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of the second argument to the .powm function, V8 will crash regardless of Node try/catch blocks.
- 9.8 Critical severity
jsgui-lang-essentials: Improperly Controlled Modification of Object Prototype Attributes
All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype.
- 8.1 High severity
dset: Improperly Controlled Modification of Object Prototype Attributes
All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it i
- 9.8 Critical severity
convict: Improperly Controlled Modification of Object Prototype Attributes
The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS
- 9.8 Critical severity
dexie: Improperly Controlled Modification of Object Prototype Attributes
The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This can
- 7.5 High severity
madlib-object-utils: Improperly Controlled Modification of Object Prototype Attributes
The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://securi
- 7.5 High severity
nconf: Improperly Controlled Modification of Object Prototype Attributes
This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype
- 9.8 Critical severity
deepmerge-ts: Improperly Controlled Modification of Object Prototype Attributes
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are
- 9.8 Critical severity
set-in: Improperly Controlled Modification of Object Prototype Attributes
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vu
- 9.8 Critical severity
libnested: Improperly Controlled Modification of Object Prototype Attributes
The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)
- 7.3 High severity
bodymen: Improperly Controlled Modification of Object Prototype Attributes
The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix
- 10.0 Critical severity
parse-server: Improperly Controlled Modification of Object Prototype Attributes
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that
- 8.2 High severity
Node: Improperly Controlled Modification of Object Prototype Attributes
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could b
- 9.8 Critical severity
Plist: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
- 9.8 Critical severity
superjson: Improperly Controlled Modification of Object Prototype Attributes
superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requi
- 8.8 High severity
Frourio-express is a minimal full stack framework, for TypeScript.
Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Valida
- 8.8 High severity
Frourio is a full stack framework, for TypeScript.
Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for re