CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
859 vulnerabilities reference this CWE, most recent first.
GHSA-C96F-X56V-GQ3H
Vulnerability from github – Published: 2026-07-23 19:33 – Updated: 2026-07-23 19:33Impact
Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.
The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.
Patches
Upgrade to v9.7.0.
Workarounds
Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.6.0"
},
"package": {
"ecosystem": "npm",
"name": "find-my-way"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47219"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-23T19:33:15Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nRemotely triggerable DoS in find-my-way when it is used with Node\u0027s HTTP/2 server.\n\nThe short version is that `lookup()` passes `req.method` into `find()`, and `find()` indexes `this.trees[method]`. Since `this.trees` is a normal object, HTTP/2 method values like constructor, `toString`, or `__proto__` can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches `currentNode.prefix.length`.\n\n### Patches\n\nUpgrade to v9.7.0.\n\n### Workarounds\n\nDo not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.",
"id": "GHSA-c96f-x56v-gq3h",
"modified": "2026-07-23T19:33:15Z",
"published": "2026-07-23T19:33:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h"
},
{
"type": "WEB",
"url": "https://github.com/delvedor/find-my-way/pull/434"
},
{
"type": "WEB",
"url": "https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1"
},
{
"type": "PACKAGE",
"url": "https://github.com/delvedor/find-my-way"
},
{
"type": "WEB",
"url": "https://github.com/delvedor/find-my-way/releases/tag/v9.7.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "find-my-way: DDoS with HTTP2"
}
GHSA-CC8P-78QF-8P7Q
Vulnerability from github – Published: 2025-09-24 21:30 – Updated: 2025-09-26 18:31A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution vulnerabilities by injecting malicious input values (e.g., "proto"), enabling unauthorized modification of the JavaScript Object prototype chain. Successful exploitation could lead to denial of service conditions, unexpected application behavior, or potential execution of arbitrary code in contexts where polluted properties are later accessed or executed. The issue affects versions prior to 7.0.11 and remains unpatched at the time of disclosure.
{
"affected": [],
"aliases": [
"CVE-2025-57347"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-24T19:15:39Z",
"severity": "CRITICAL"
},
"details": "A vulnerability exists in the \u0027dagre-d3-es\u0027 Node.js package version 7.0.9, specifically within the \u0027bk\u0027 module\u0027s addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution vulnerabilities by injecting malicious input values (e.g., \"__proto__\"), enabling unauthorized modification of the JavaScript Object prototype chain. Successful exploitation could lead to denial of service conditions, unexpected application behavior, or potential execution of arbitrary code in contexts where polluted properties are later accessed or executed. The issue affects versions prior to 7.0.11 and remains unpatched at the time of disclosure.",
"id": "GHSA-cc8p-78qf-8p7q",
"modified": "2025-09-26T18:31:19Z",
"published": "2025-09-24T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57347"
},
{
"type": "WEB",
"url": "https://github.com/tbo47/dagre-es/issues/52"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57347"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CFGR-75JX-H88G
Vulnerability from github – Published: 2022-10-31 19:00 – Updated: 2024-04-22 23:20Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.8.15"
},
"package": {
"ecosystem": "npm",
"name": "browserify-shim"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-37623"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:20:54Z",
"nvd_published_at": "2022-10-31T12:15:00Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.",
"id": "GHSA-cfgr-75jx-h88g",
"modified": "2024-04-22T23:20:54Z",
"published": "2022-10-31T19:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37623"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/issues/248"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/pull/246"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/commit/97855e622b6dcd117c77e6583701962ff45e7338"
},
{
"type": "PACKAGE",
"url": "https://github.com/thlorenz/browserify-shim"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L94"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "thlorenz browserify-shim vulnerable to prototype pollution"
}
GHSA-CFW5-2VXH-HR84
Vulnerability from github – Published: 2026-03-12 14:13 – Updated: 2026-03-12 14:13In devalue v5.6.3, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "devalue"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.6.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-30226"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-12T14:13:03Z",
"nvd_published_at": "2026-03-11T18:16:22Z",
"severity": "MODERATE"
},
"details": "In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.",
"id": "GHSA-cfw5-2vxh-hr84",
"modified": "2026-03-12T14:13:03Z",
"published": "2026-03-12T14:13:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30226"
},
{
"type": "PACKAGE",
"url": "https://github.com/sveltejs/devalue"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "devalue has prototype pollution in devalue.parse and devalue.unflatten"
}
GHSA-CH82-GQH6-9XJ9
Vulnerability from github – Published: 2020-09-04 15:13 – Updated: 2020-08-31 18:55All versions of get-setter are vulnerable to prototype pollution. The function set does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "get-setter"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:55:25Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "All versions of `get-setter` are vulnerable to prototype pollution. The function `set` does not restrict the modification of an Object\u0027s prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
"id": "GHSA-ch82-gqh6-9xj9",
"modified": "2020-08-31T18:55:25Z",
"published": "2020-09-04T15:13:19Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1332"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Prototype Pollution in get-setter"
}
GHSA-CJ63-JHHR-WCXV
Vulnerability from github – Published: 2026-04-03 03:45 – Updated: 2026-07-23 14:04Summary
When USE_PROFILES is enabled, DOMPurify rebuilds ALLOWED_ATTR as a plain array before populating it with the requested allowlists. Because the sanitizer still looks up attributes via ALLOWED_ATTR[lcName], any Array.prototype property that is polluted also counts as an allowlisted attribute. An attacker who can set Array.prototype.onclick = true (or a runtime already subject to prototype pollution) can thus force DOMPurify to keep event handlers such as onclick even when they are normally forbidden. The provided PoC sanitizes <img onclick=...> with USE_PROFILES and adds the sanitized output to the DOM; the polluted prototype allows the event handler to survive and execute, turning what should be a blocklist into a silent XSS vector.
Impact
Prototype pollution makes DOMPurify accept dangerous event handler attributes, which bypasses the sanitizer and results in DOM-based XSS once the sanitized markup is rendered.
Credits
Identified by Cantina’s Apex (https://www.cantina.security).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.3.1"
},
"package": {
"ecosystem": "npm",
"name": "dompurify"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-65913"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-03T03:45:08Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\nWhen `USE_PROFILES` is enabled, DOMPurify rebuilds `ALLOWED_ATTR` as a plain array before populating it with the requested allowlists. Because the sanitizer still looks up attributes via `ALLOWED_ATTR[lcName]`, any `Array.prototype` property that is polluted also counts as an allowlisted attribute. An attacker who can set `Array.prototype.onclick = true` (or a runtime already subject to prototype pollution) can thus force DOMPurify to keep event handlers such as `onclick` even when they are normally forbidden. The provided PoC sanitizes `\u003cimg onclick=...\u003e` with `USE_PROFILES` and adds the sanitized output to the DOM; the polluted prototype allows the event handler to survive and execute, turning what should be a blocklist into a silent XSS vector.\n\n## Impact\nPrototype pollution makes DOMPurify accept dangerous event handler attributes, which bypasses the sanitizer and results in DOM-based XSS once the sanitized markup is rendered.\n\n## Credits\nIdentified by Cantina\u2019s Apex (https://www.cantina.security).",
"id": "GHSA-cj63-jhhr-wcxv",
"modified": "2026-07-23T14:04:52Z",
"published": "2026-04-03T03:45:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv"
},
{
"type": "PACKAGE",
"url": "https://github.com/cure53/DOMPurify"
},
{
"type": "WEB",
"url": "https://github.com/cure53/DOMPurify/releases/tag/3.3.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "DOMPurify USE_PROFILES prototype pollution allows event handlers"
}
GHSA-CMXG-94MG-JQ94
Vulnerability from github – Published: 2026-05-18 17:07 – Updated: 2026-05-18 17:07Impact
Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().
Patches
A fix is available in versions 20260509.0340.15 and up.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@tmlmobilidade/utils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "20260509.0340.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45325"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-18T17:07:04Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nPrototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().\n\n### Patches\nA fix is available in versions 20260509.0340.15 and up.",
"id": "GHSA-cmxg-94mg-jq94",
"modified": "2026-05-18T17:07:04Z",
"published": "2026-05-18T17:07:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tmlmobilidade/go/security/advisories/GHSA-cmxg-94mg-jq94"
},
{
"type": "WEB",
"url": "https://github.com/tmlmobilidade/go/commit/b10505baa7ba0701f830a05f3007c0a6bdd00eb7"
},
{
"type": "PACKAGE",
"url": "https://github.com/tmlmobilidade/go"
},
{
"type": "WEB",
"url": "https://github.com/tmlmobilidade/go/blob/prd/packages/utils/src/generic/value-at-path.ts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "@tmlmobilidade/utils has prototype pollution in its setValueAtPath"
}
GHSA-CP6Q-959Q-F8RH
Vulnerability from github – Published: 2026-09-02 14:44 – Updated: 2026-09-02 14:44Summary
@tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, while Object.keys() and ordinary own-property checks show no attacker attributes.
When that result is used as a ProseMirror DOMOutputSpec attribute object, prosemirror-model's DOMSerializer.renderSpec() enumerates it with for...in and applies inherited values with setAttribute(). In a browser proof, inherited src and onerror values were copied to an <img> and the error handler executed once. This is per-object prototype manipulation; the proof does not modify global Object.prototype.
Root cause
The affected loop is conceptually:
const mergedAttributes = { ...items }
for (const [key, value] of Object.entries(item)) {
const exists = mergedAttributes[key]
// ...
mergedAttributes[key] = value
}
Object.entries(JSON.parse('{"__proto__": {...}}')) includes __proto__. Reading mergedAttributes['__proto__'] resolves the inherited Object.prototype; assigning to the same key invokes Object.prototype.__proto__'s setter and replaces mergedAttributes' prototype.
Browser reproduction
The following shape was tested with exact @tiptap/core 3.29.2 and prosemirror-model 1.25.11:
const input = JSON.parse(`{
"__proto__": {
"data-inherited-canary": "present",
"src": "x-invalid://canary",
"onerror": "globalThis.__tiptapXss += 1"
}
}`)
const attrs = mergeAttributes(input)
// Object.keys(attrs) === []
// Object.getPrototypeOf(attrs) === input.__proto__
const schema = new Schema({
nodes: {
doc: { content: 'image' },
image: { toDOM: () => ['img', attrs] },
text: {},
},
})
const doc = schema.node('doc', null, [schema.node('image')])
const fragment = DOMSerializer.fromSchema(schema).serializeFragment(doc.content)
document.body.append(fragment)
Chromium produced an image with data-inherited-canary, src, and onerror; the handler executed exactly once. Object.prototype remained clean.
Impact and preconditions
Applications that merge untrusted imported document, plugin, CMS, API, tenant, or AI-derived attribute objects can receive a prototype-manipulated result. Consumers that enumerate inherited keys, including ProseMirror's DOM serializer, can turn the hidden properties into DOM attributes and execute JavaScript in the application's origin. Own-key validation, object spread, JSON serialization, and logging can miss the inherited values. Other component consumers can read inherited authorization or configuration fields.
Tiptap's standard fixed ProseMirror schemas discard unknown document attributes, so arbitrary Tiptap JSON is not automatically exploitable in every application. A vulnerable application needs an untrusted object boundary into mergeAttributes() or a dynamic/custom extension or schema that preserves the relevant attribute object.
Affected versions
The unsafe assignment was introduced in commit ecadf7ea0a7f8f39a8496a60edf0ac8f379e6eb3 and is present in the first package tag @tiptap/core@2.0.0-alpha.0, v2.0.0, v2.27.1, v3.0.0, and current v3.29.2 source. No fixed release was found.
Recommended remediation
Reject __proto__ before reading or assigning the key, or define copied keys as own data properties without invoking legacy setters. A minimal hardening is to skip key === '__proto__'. Add regression tests using an own JSON-origin __proto__ key and assert that the result keeps Object.prototype as its prototype, exposes no inherited attacker keys, and cannot create an event-handler attribute through DOMSerializer.
This was found during authorized dependency review and is being reported privately. No public zero-day issue has been opened.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@tiptap/core"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-alpha.0"
},
{
"fixed": "3.30.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T14:44:39Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\n`@tiptap/core`\u0027s public `mergeAttributes()` helper uses ordinary bracket assignment on keys returned by `Object.entries()`. An own `__proto__` key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, while `Object.keys()` and ordinary own-property checks show no attacker attributes.\n\nWhen that result is used as a ProseMirror DOMOutputSpec attribute object, `prosemirror-model`\u0027s `DOMSerializer.renderSpec()` enumerates it with `for...in` and applies inherited values with `setAttribute()`. In a browser proof, inherited `src` and `onerror` values were copied to an `\u003cimg\u003e` and the error handler executed once. This is per-object prototype manipulation; the proof does not modify global `Object.prototype`.\n\n## Root cause\n\nThe affected loop is conceptually:\n\n```ts\nconst mergedAttributes = { ...items }\nfor (const [key, value] of Object.entries(item)) {\n const exists = mergedAttributes[key]\n // ...\n mergedAttributes[key] = value\n}\n```\n\n`Object.entries(JSON.parse(\u0027{\"__proto__\": {...}}\u0027))` includes `__proto__`. Reading `mergedAttributes[\u0027__proto__\u0027]` resolves the inherited `Object.prototype`; assigning to the same key invokes `Object.prototype.__proto__`\u0027s setter and replaces `mergedAttributes`\u0027 prototype.\n\n## Browser reproduction\n\nThe following shape was tested with exact `@tiptap/core` 3.29.2 and `prosemirror-model` 1.25.11:\n\n```js\nconst input = JSON.parse(`{\n \"__proto__\": {\n \"data-inherited-canary\": \"present\",\n \"src\": \"x-invalid://canary\",\n \"onerror\": \"globalThis.__tiptapXss += 1\"\n }\n}`)\n\nconst attrs = mergeAttributes(input)\n// Object.keys(attrs) === []\n// Object.getPrototypeOf(attrs) === input.__proto__\n\nconst schema = new Schema({\n nodes: {\n doc: { content: \u0027image\u0027 },\n image: { toDOM: () =\u003e [\u0027img\u0027, attrs] },\n text: {},\n },\n})\nconst doc = schema.node(\u0027doc\u0027, null, [schema.node(\u0027image\u0027)])\nconst fragment = DOMSerializer.fromSchema(schema).serializeFragment(doc.content)\ndocument.body.append(fragment)\n```\n\nChromium produced an image with `data-inherited-canary`, `src`, and `onerror`; the handler executed exactly once. `Object.prototype` remained clean.\n\n## Impact and preconditions\n\nApplications that merge untrusted imported document, plugin, CMS, API, tenant, or AI-derived attribute objects can receive a prototype-manipulated result. Consumers that enumerate inherited keys, including ProseMirror\u0027s DOM serializer, can turn the hidden properties into DOM attributes and execute JavaScript in the application\u0027s origin. Own-key validation, object spread, JSON serialization, and logging can miss the inherited values. Other component consumers can read inherited authorization or configuration fields.\n\nTiptap\u0027s standard fixed ProseMirror schemas discard unknown document attributes, so arbitrary Tiptap JSON is not automatically exploitable in every application. A vulnerable application needs an untrusted object boundary into `mergeAttributes()` or a dynamic/custom extension or schema that preserves the relevant attribute object.\n\n## Affected versions\n\nThe unsafe assignment was introduced in commit `ecadf7ea0a7f8f39a8496a60edf0ac8f379e6eb3` and is present in the first package tag `@tiptap/core@2.0.0-alpha.0`, v2.0.0, v2.27.1, v3.0.0, and current v3.29.2 source. No fixed release was found.\n\n## Recommended remediation\n\nReject `__proto__` before reading or assigning the key, or define copied keys as own data properties without invoking legacy setters. A minimal hardening is to skip `key === \u0027__proto__\u0027`. Add regression tests using an own JSON-origin `__proto__` key and assert that the result keeps `Object.prototype` as its prototype, exposes no inherited attacker keys, and cannot create an event-handler attribute through `DOMSerializer`.\n\nThis was found during authorized dependency review and is being reported privately. No public zero-day issue has been opened.",
"id": "GHSA-cp6q-959q-f8rh",
"modified": "2026-09-02T14:44:39Z",
"published": "2026-09-02T14:44:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ueberdosis/tiptap/security/advisories/GHSA-cp6q-959q-f8rh"
},
{
"type": "WEB",
"url": "https://github.com/ueberdosis/tiptap/commit/01d7af8c983ee5954c63734f4fa46cb23ae3246d"
},
{
"type": "PACKAGE",
"url": "https://github.com/ueberdosis/tiptap"
},
{
"type": "WEB",
"url": "https://github.com/ueberdosis/tiptap/releases/tag/v3.30.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes"
}
GHSA-CQQH-49MX-FQ63
Vulnerability from github – Published: 2021-09-13 20:16 – Updated: 2022-08-10 23:45merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@viking04/merge"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3645"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-13T19:14:06Z",
"nvd_published_at": "2021-09-10T11:15:00Z",
"severity": "CRITICAL"
},
"details": "merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"id": "GHSA-cqqh-49mx-fq63",
"modified": "2022-08-10T23:45:09Z",
"published": "2021-09-13T20:16:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3645"
},
{
"type": "WEB",
"url": "https://github.com/viking04/merge/commit/baba40332080b38b33840d2614df6d4142dedaf6"
},
{
"type": "PACKAGE",
"url": "https://github.com/viking04/merge"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/ef387a9e-ca3c-4c21-80e3-d34a6a896262"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "merge vulnerable to Prototype Pollution"
}
GHSA-CR7H-93FH-WHWM
Vulnerability from github – Published: 2025-09-24 21:30 – Updated: 2025-09-25 17:52A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions through 2.2.2 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "magix-combine-ex"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-57321"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-25T17:52:23Z",
"nvd_published_at": "2025-09-24T20:15:31Z",
"severity": "LOW"
},
"details": "A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions through 2.2.2 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.",
"id": "GHSA-cr7h-93fh-whwm",
"modified": "2025-09-25T17:52:42Z",
"published": "2025-09-24T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57321"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/magix-combine-ex%401.2.10/index.js"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57321"
},
{
"type": "PACKAGE",
"url": "https://github.com/thx/magix-combine"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "magix-combine-ex vulnerable to prototype pollution"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.