CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
958 vulnerabilities reference this CWE, most recent first.
GHSA-8CW4-87C7-C6XX
Vulnerability from github – Published: 2026-09-08 18:01 – Updated: 2026-09-08 18:01Impact
With columns: true and group_columns_by_name: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj['proto'], invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).
Patches
The problem been patched.
Workarounds
Disable usage of both the columns and group_columns_by_name options.
References
issue #496, PR #497
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "csv-parse"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-85063"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-08T18:01:39Z",
"nvd_published_at": "2026-09-03T21:17:23Z",
"severity": "MODERATE"
},
"details": "### Impact\nWith columns: true and group_columns_by_name: true, a duplicated __proto__ header causes the duplicate-column branch to assign an array to obj[\u0027__proto__\u0027], invoking the __proto__ setter and replacing the parsed record object\u0027s prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).\n\n### Patches\nThe problem been patched.\n\n### Workarounds\nDisable usage of both the columns and group_columns_by_name options.\n\n### References\nissue #496, PR #497",
"id": "GHSA-8cw4-87c7-c6xx",
"modified": "2026-09-08T18:01:39Z",
"published": "2026-09-08T18:01:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85063"
},
{
"type": "WEB",
"url": "https://github.com/adaltas/node-csv/issues/496"
},
{
"type": "WEB",
"url": "https://github.com/adaltas/node-csv/pull/497"
},
{
"type": "WEB",
"url": "https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e"
},
{
"type": "PACKAGE",
"url": "https://github.com/adaltas/node-csv"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "node-csv: Prototype replacement still reachable via columns path"
}
GHSA-8F8G-9J73-7P82
Vulnerability from github – Published: 2022-09-16 00:00 – Updated: 2022-09-21 21:07Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "steal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-37264"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-21T21:07:43Z",
"nvd_published_at": "2022-09-15T16:15:00Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.",
"id": "GHSA-8f8g-9j73-7p82",
"modified": "2022-09-21T21:07:43Z",
"published": "2022-09-16T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37264"
},
{
"type": "WEB",
"url": "https://github.com/stealjs/steal/issues/1533"
},
{
"type": "PACKAGE",
"url": "https://github.com/stealjs/steal"
},
{
"type": "WEB",
"url": "https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L2194"
},
{
"type": "WEB",
"url": "https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L647"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "steal vulnerable to Prototype Pollution via optionName variable"
}
GHSA-8G4M-CJM2-96WQ
Vulnerability from github – Published: 2022-03-18 00:01 – Updated: 2022-03-25 16:47This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. Note: This vulnerability derives from an incomplete fix in SNYK-JS-NOTEVIL-608878. This package has been deprecated.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "notevil"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "argencoders-notevil"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23771"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-18T23:07:57Z",
"nvd_published_at": "2022-03-17T12:15:00Z",
"severity": "MODERATE"
},
"details": "This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object\u0027s prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878). This package has been deprecated.",
"id": "GHSA-8g4m-cjm2-96wq",
"modified": "2022-03-25T16:47:42Z",
"published": "2022-03-18T00:01:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23771"
},
{
"type": "PACKAGE",
"url": "https://github.com/mmckegg/notevil"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Sandbox escape in notevil and argencoders-notevil"
}
GHSA-8G77-54RH-46HX
Vulnerability from github – Published: 2025-03-12 21:31 – Updated: 2025-03-20 19:27An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-git-config"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-25975"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-16T17:22:50Z",
"nvd_published_at": "2025-03-12T19:15:40Z",
"severity": "HIGH"
},
"details": "An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function.",
"id": "GHSA-8g77-54rh-46hx",
"modified": "2025-03-20T19:27:20Z",
"published": "2025-03-12T21:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25975"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/parse-git-config/issues/14"
},
{
"type": "PACKAGE",
"url": "https://github.com/jonschlinkert/parse-git-config"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Prototype Pollution Vulnerability in parse-git-config"
}
GHSA-8GH8-HQWG-XF34
Vulnerability from github – Published: 2022-12-25 21:30 – Updated: 2024-03-01 14:21A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 can address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "fast-json-patch"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-4279"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-30T16:27:22Z",
"nvd_published_at": "2022-12-25T20:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 can address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.",
"id": "GHSA-8gh8-hqwg-xf34",
"modified": "2024-03-01T14:21:21Z",
"published": "2022-12-25T21:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4279"
},
{
"type": "WEB",
"url": "https://github.com/Starcounter-Jack/JSON-Patch/pull/262"
},
{
"type": "WEB",
"url": "https://github.com/Starcounter-Jack/JSON-Patch/commit/7ad6af41eabb2d799f698740a91284d762c955c9"
},
{
"type": "WEB",
"url": "https://blog.effectrenan.com/pwn2win-2021-illusion-web-challenge"
},
{
"type": "PACKAGE",
"url": "https://github.com/Starcounter-Jack/JSON-Patch"
},
{
"type": "WEB",
"url": "https://github.com/Starcounter-Jack/JSON-Patch/releases/tag/3.1.1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.216778"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.216778"
},
{
"type": "WEB",
"url": "https://www.huntr.dev/bounties/1-npm-fast-json-patch"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Starcounter-Jack JSON-Patch Prototype Pollution vulnerability"
}
GHSA-8GW3-RXH4-V6JX
Vulnerability from github – Published: 2025-11-14 18:31 – Updated: 2025-11-17 18:39npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "expr-eval"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "expr-eval-fork"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-13204"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-17T18:39:19Z",
"nvd_published_at": "2025-11-14T17:16:01Z",
"severity": "HIGH"
},
"details": "npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue.",
"id": "GHSA-8gw3-rxh4-v6jx",
"modified": "2025-11-17T18:39:19Z",
"published": "2025-11-14T18:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13204"
},
{
"type": "WEB",
"url": "https://github.com/silentmatt/expr-eval/pull/252/files"
},
{
"type": "WEB",
"url": "https://github.com/jorenbroekema/expr-eval/commit/6c475a118643ae0efe012de283e932fb8b74324b"
},
{
"type": "WEB",
"url": "https://github.com/silentmatt/expr-eval/commit/6e889e0e75c50ac37d70c35388602025650e0c50"
},
{
"type": "WEB",
"url": "https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py"
},
{
"type": "WEB",
"url": "https://github.com/jorenbroekema/expr-eval"
},
{
"type": "PACKAGE",
"url": "https://github.com/silentmatt/expr-eval"
},
{
"type": "WEB",
"url": "https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py"
},
{
"type": "WEB",
"url": "https://www.huntr.dev/bounties/1-npm-expr-eval"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/expr-eval-fork"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "expr-eval vulnerable to Prototype Pollution"
}
GHSA-8GWJ-8HXC-285W
Vulnerability from github – Published: 2021-11-08 17:43 – Updated: 2021-11-08 17:43This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "json-ptr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23509"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-843"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-04T16:56:49Z",
"nvd_published_at": "2021-11-03T18:15:00Z",
"severity": "MODERATE"
},
"details": "This affects the package `json-ptr` before `3.0.0`. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.",
"id": "GHSA-8gwj-8hxc-285w",
"modified": "2021-11-08T17:43:16Z",
"published": "2021-11-08T17:43:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23509"
},
{
"type": "WEB",
"url": "https://github.com/flitbit/json-ptr/pull/42"
},
{
"type": "WEB",
"url": "https://github.com/flitbit/json-ptr/commit/5dc458fbad1c382a2e3ca6d62e66ede3d92849ca"
},
{
"type": "PACKAGE",
"url": "https://github.com/flitbit/json-ptr"
},
{
"type": "WEB",
"url": "https://github.com/flitbit/json-ptr%23security-vulnerabilities-resolved"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-JSONPTR-1577291"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in json-ptr"
}
GHSA-8HQ7-GGX2-CC6M
Vulnerability from github – Published: 2026-10-08 17:39 – Updated: 2026-10-08 17:39Impact
Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a __proto__ key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.
Only the decoded object's prototype is affected; this does not modify Object.prototype globally.
Patches
Options are now merged with secure defaults without modifying the caller's object. Unsupported protoAction values are rejected.
Workarounds
Explicitly set protoAction: 'error' whenever constructing a msgpack5 instance, and validate decoded values before use.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "msgpack5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-107301"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-08T17:39:57Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\n\nPassing an empty or partial options object disables the default `protoAction: \u0027error\u0027` protection. A map containing a `__proto__` key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.\n\nOnly the decoded object\u0027s prototype is affected; this does not modify `Object.prototype` globally.\n\n### Patches\n\nOptions are now merged with secure defaults without modifying the caller\u0027s object. Unsupported `protoAction` values are rejected.\n\n### Workarounds\n\nExplicitly set `protoAction: \u0027error\u0027` whenever constructing a msgpack5 instance, and validate decoded values before use.",
"id": "GHSA-8hq7-ggx2-cc6m",
"modified": "2026-10-08T17:39:57Z",
"published": "2026-10-08T17:39:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m"
},
{
"type": "WEB",
"url": "https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774"
},
{
"type": "PACKAGE",
"url": "https://github.com/mcollina/msgpack5"
},
{
"type": "WEB",
"url": "https://github.com/mcollina/msgpack5/releases/tag/v6.1.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "msgpack5: Partial options disable prototype protection"
}
GHSA-8HQ9-PHH3-P2WP
Vulnerability from github – Published: 2026-03-17 16:17 – Updated: 2026-03-19 19:01Impact
Elysia cookie can be overridden by prototype pollution , eg. __proto__
Sending cookie with the follows name can override cookie value:
__proto__=%7B%22injected%22%3A%22polluted%22%7D
Patches
Patched by 1.4.27
Workarounds
- Use t.Cookie validation to enforce validation value
- Prevent iterable over cookie if possible
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "elysia"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.27"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-31865"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-17T16:17:41Z",
"nvd_published_at": "2026-03-18T04:17:19Z",
"severity": "MODERATE"
},
"details": "### Impact\nElysia cookie can be overridden by prototype pollution , eg. `__proto__`\n\nSending cookie with the follows name can override cookie value:\n```bash\n__proto__=%7B%22injected%22%3A%22polluted%22%7D\n```\n\n### Patches\nPatched by 1.4.27\n\n### Workarounds\n1. Use t.Cookie validation to enforce validation value\n2. Prevent iterable over cookie if possible",
"id": "GHSA-8hq9-phh3-p2wp",
"modified": "2026-03-19T19:01:12Z",
"published": "2026-03-17T16:17:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/elysiajs/elysia/security/advisories/GHSA-8hq9-phh3-p2wp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31865"
},
{
"type": "WEB",
"url": "https://github.com/elysiajs/elysia/commit/e9d6b1743fa7368ef942dce181f6a089757f6aab"
},
{
"type": "PACKAGE",
"url": "https://github.com/elysiajs/elysia"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Elysia Cookie Value Prototype Pollution"
}
GHSA-8J49-49JQ-VWCQ
Vulnerability from github – Published: 2020-09-04 15:15 – Updated: 2020-08-31 18:55All versions of getsetdeep are vulnerable to prototype pollution. The setDeep() function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "getsetdeep"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:55:30Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "All versions of `getsetdeep` are vulnerable to prototype pollution. The `setDeep()` function does not restrict the modification of an Object\u0027s prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
"id": "GHSA-8j49-49jq-vwcq",
"modified": "2020-08-31T18:55:30Z",
"published": "2020-09-04T15:15:34Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1334"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Prototype Pollution in getsetdeep"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.