CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
962 vulnerabilities reference this CWE, most recent first.
GHSA-3GQC-3HVH-6HCG
Vulnerability from github – Published: 2022-05-13 01:20 – Updated: 2022-05-13 01:20admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.
{
"affected": [],
"aliases": [
"CVE-2018-6195"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-30T20:29:00Z",
"severity": "HIGH"
},
"details": "admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the \u0027session\u0027 HTTP GET parameter to wp-admin/upload.php.",
"id": "GHSA-3gqc-3hvh-6hcg",
"modified": "2022-05-13T01:20:30Z",
"published": "2022-05-13T01:20:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6195"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/1807349/wp-splashing-images"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/9015"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/146109/WordPress-Splashing-Images-2.1-Cross-Site-Scripting-PHP-Object-Injection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2018/Jan/91"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3HVJ-2783-34X2
Vulnerability from github – Published: 2024-05-16 18:30 – Updated: 2024-11-18 16:26njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "njwt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-34273"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T16:01:47Z",
"nvd_published_at": "2024-05-16T16:15:08Z",
"severity": "HIGH"
},
"details": "njwt up to v0.4.0 was discovered to contain a prototype pollution in the `Parser.prototype.parse` method.",
"id": "GHSA-3hvj-2783-34x2",
"modified": "2024-11-18T16:26:42Z",
"published": "2024-05-16T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34273"
},
{
"type": "WEB",
"url": "https://github.com/jwtk/njwt/issues/105"
},
{
"type": "WEB",
"url": "https://github.com/jwtk/njwt/commit/ec9483b6eec1150d56f772ddd308c2bbdf2f98f4"
},
{
"type": "WEB",
"url": "https://github.com/chrisandoryan/vuln-advisory/blob/main/nJwt/CVE-2024-34273.md"
},
{
"type": "PACKAGE",
"url": "https://github.com/jwtk/njwt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "njwt Prototype Pollution vulnerability"
}
GHSA-3JC6-6R48-V6QF
Vulnerability from github – Published: 2026-04-20 03:34 – Updated: 2026-04-23 14:23A Prototype Pollution vulnerability was determined in brikcss merge up to 1.3.0. Executing a manipulation of the argument proto/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@brikcss/merge"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-6594"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-23T14:23:26Z",
"nvd_published_at": "2026-04-20T02:16:15Z",
"severity": "MODERATE"
},
"details": "A Prototype Pollution vulnerability was determined in brikcss merge up to 1.3.0. Executing a manipulation of the argument __proto__/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-3jc6-6r48-v6qf",
"modified": "2026-04-23T14:23:26Z",
"published": "2026-04-20T03:34:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6594"
},
{
"type": "PACKAGE",
"url": "https://github.com/brikcss/merge"
},
{
"type": "WEB",
"url": "https://github.com/sudo-secure/security-research/blob/main/brikcss-merge/prototype-pollution/PoC.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/791805"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/358229"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/358229/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization"
}
GHSA-3JP5-5F8R-Q2WG
Vulnerability from github – Published: 2025-12-12 21:31 – Updated: 2025-12-12 22:14The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.
If the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.
This issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.
Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "vuetify"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0-beta.2"
},
{
"fixed": "3.0.0-alpha.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-8083"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-12T22:14:53Z",
"nvd_published_at": "2025-12-12T20:15:43Z",
"severity": "HIGH"
},
"details": "The Preset configuration\u00a0feature of Vuetify is vulnerable to Prototype Pollution due to the internal \u0027mergeDeep\u0027 utility function used to merge options with defaults.\u00a0Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application\u0027s behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.\n\nIf the application utilizes\u00a0Server-Side Rendering (SSR), this vulnerability could affect the whole server process.\n\nThis issue affects Vuetify versions greater than or equal to 2.2.0-beta.2\u00a0and less than 3.0.0-alpha.10.\n\nNote:\nVersion 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see here https://v2.vuetifyjs.com/en/about/eol/ .",
"id": "GHSA-3jp5-5f8r-q2wg",
"modified": "2025-12-12T22:14:53Z",
"published": "2025-12-12T21:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8083"
},
{
"type": "WEB",
"url": "https://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755"
},
{
"type": "PACKAGE",
"url": "https://github.com/vuetifyjs/vuetify"
},
{
"type": "WEB",
"url": "https://www.herodevs.com/vulnerability-directory/cve-2025-8083"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Vuetify has a Prototype Pollution vulnerability"
}
GHSA-3MPM-JX38-9M8W
Vulnerability from github – Published: 2025-09-24 21:30 – Updated: 2025-09-25 19:29A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sassdoc-extras"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-57326"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-25T19:29:06Z",
"nvd_published_at": "2025-09-24T20:15:32Z",
"severity": "LOW"
},
"details": "A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.",
"id": "GHSA-3mpm-jx38-9m8w",
"modified": "2025-09-25T19:29:06Z",
"published": "2025-09-24T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57326"
},
{
"type": "PACKAGE",
"url": "https://github.com/SassDoc/sassdoc-extras"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/sassdoc-extras%402.5.1/index.js"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57326"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "sassdoc-extras vulnerable to prototype pollution"
}
GHSA-3PX8-VGVR-H92Q
Vulnerability from github – Published: 2022-05-13 01:18 – Updated: 2022-05-13 01:18The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks.
{
"affected": [],
"aliases": [
"CVE-2018-11135"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-31T18:29:00Z",
"severity": "HIGH"
},
"details": "The script \u0027/adminui/error_details.php\u0027 in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks.",
"id": "GHSA-3px8-vgvr-h92q",
"modified": "2022-05-13T01:18:53Z",
"published": "2022-05-13T01:18:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11135"
},
{
"type": "WEB",
"url": "https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3Q56-9CC2-46J4
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-10 16:03robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "fast-loops"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-39008"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-10T16:03:48Z",
"nvd_published_at": "2024-07-01T13:15:05Z",
"severity": "HIGH"
},
"details": "robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function `objectMergeDeep`. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
"id": "GHSA-3q56-9cc2-46j4",
"modified": "2024-07-10T16:03:48Z",
"published": "2024-07-01T15:32:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39008"
},
{
"type": "WEB",
"url": "https://github.com/robinweser/fast-loops/commit/6743acf64af832b7a0bbecf95cb4c7d95a3b766e"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/f09a507c8d59fbbb7fd40880cd9b87ed"
},
{
"type": "PACKAGE",
"url": "https://github.com/robinweser/fast-loops"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "robinweser fast-loops vulnerable to prototype pollution"
}
GHSA-3QF9-64J6-3672
Vulnerability from github – Published: 2023-10-20 18:30 – Updated: 2024-04-04 08:51The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
{
"affected": [],
"aliases": [
"CVE-2023-3933"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-79"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-20T16:15:19Z",
"severity": "MODERATE"
},
"details": "The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
"id": "GHSA-3qf9-64j6-3672",
"modified": "2024-04-04T08:51:25Z",
"published": "2023-10-20T18:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3933"
},
{
"type": "WEB",
"url": "https://github.com/BlackFan/client-side-prototype-pollution"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c738e051-ad1c-4115-94d3-127dd5dff935?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3R53-75J5-3G7J
Vulnerability from github – Published: 2026-07-24 22:36 – Updated: 2026-08-13 17:57Summary
quasar@2.20.1, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the package root.
When extend(true, target, source) is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as __proto__, constructor, or prototype.
This can allow attacker-controlled properties to be written to Object.prototype.
Details
Affected source:
src/utils/extend/extend.js
Distributed files include:
dist/quasar.server.prod.js
dist/quasar.server.prod.cjs
dist/quasar.client.js
The package root publicly exports extend. During deep merge, source object keys are recursively assigned into the target object. If the source object contains an own __proto__ property, the merge can descend into the prototype object and assign attacker-controlled properties onto Object.prototype.
PoC
rm -rf /tmp/quasar-extend-pp-poc
mkdir /tmp/quasar-extend-pp-poc
cd /tmp/quasar-extend-pp-poc
npm init -y >/dev/null
npm install quasar@2.20.1 vue@3.5.31 >/dev/null
cat > hack.mjs <<'JS'
import { extend } from 'quasar';
delete Object.prototype.polluted;
extend(true, {}, {
['__proto__']: {
polluted: 'yes'
}
});
console.log(({}).polluted);
delete Object.prototype.polluted;
JS
node ./hack.mjs
Observed output:
yes
Expected output:
undefined
Impact
This is a prototype pollution vulnerability.
If an application passes user-controlled or partially user-controlled objects into extend(true, ...), an attacker may be able to pollute Object.prototype in the same JavaScript process.
Depending on how the polluted property is later consumed, this may lead to logic bypass, unsafe default option injection, denial of service, or other application-specific security impact.
Suggested Fix
Reject or safely ignore dangerous keys before assignment, including:
__proto__
prototype
constructor
The merge implementation should also avoid descending into prototype-related properties during recursive merge.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.21.4"
},
"package": {
"ecosystem": "npm",
"name": "quasar"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.22.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-73647"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T22:36:45Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\n`quasar@2.20.1`, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public `extend()` utility exported from the package root.\n\nWhen `extend(true, target, source)` is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as `__proto__`, `constructor`, or `prototype`.\n\nThis can allow attacker-controlled properties to be written to `Object.prototype`.\n\n### Details\n\nAffected source:\n\n```text\nsrc/utils/extend/extend.js\n```\n\nDistributed files include:\n\n```text\ndist/quasar.server.prod.js\ndist/quasar.server.prod.cjs\ndist/quasar.client.js\n```\n\nThe package root publicly exports `extend`. During deep merge, source object keys are recursively assigned into the target object. If the source object contains an own `__proto__` property, the merge can descend into the prototype object and assign attacker-controlled properties onto `Object.prototype`.\n\n### PoC\n\n```bash\nrm -rf /tmp/quasar-extend-pp-poc\nmkdir /tmp/quasar-extend-pp-poc\ncd /tmp/quasar-extend-pp-poc\n\nnpm init -y \u003e/dev/null\nnpm install quasar@2.20.1 vue@3.5.31 \u003e/dev/null\n\ncat \u003e hack.mjs \u003c\u003c\u0027JS\u0027\nimport { extend } from \u0027quasar\u0027;\n\ndelete Object.prototype.polluted;\n\nextend(true, {}, {\n [\u0027__proto__\u0027]: {\n polluted: \u0027yes\u0027\n }\n});\n\nconsole.log(({}).polluted);\n\ndelete Object.prototype.polluted;\nJS\n\nnode ./hack.mjs\n```\n\nObserved output:\n\n```text\nyes\n```\n\nExpected output:\n\n```text\nundefined\n```\n\n### Impact\n\nThis is a prototype pollution vulnerability.\n\nIf an application passes user-controlled or partially user-controlled objects into `extend(true, ...)`, an attacker may be able to pollute `Object.prototype` in the same JavaScript process.\n\nDepending on how the polluted property is later consumed, this may lead to logic bypass, unsafe default option injection, denial of service, or other application-specific security impact.\n\n### Suggested Fix\n\nReject or safely ignore dangerous keys before assignment, including:\n\n```text\n__proto__\nprototype\nconstructor\n```\n\nThe merge implementation should also avoid descending into prototype-related properties during recursive merge.",
"id": "GHSA-3r53-75j5-3g7j",
"modified": "2026-08-13T17:57:16Z",
"published": "2026-07-24T22:36:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
},
{
"type": "WEB",
"url": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7"
},
{
"type": "PACKAGE",
"url": "https://github.com/quasarframework/quasar"
},
{
"type": "WEB",
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Quasar: Prototype pollution in the extend() utility"
}
GHSA-3R8W-MPHV-2F3F
Vulnerability from github – Published: 2021-06-21 17:12 – Updated: 2023-08-08 19:57All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "lutils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23396"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-18T18:35:57Z",
"nvd_published_at": "2021-06-17T17:15:00Z",
"severity": "MODERATE"
},
"details": "All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.",
"id": "GHSA-3r8w-mphv-2f3f",
"modified": "2023-08-08T19:57:21Z",
"published": "2021-06-21T17:12:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23396"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-LUTILS-1311023"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in lutils"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.