CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
958 vulnerabilities reference this CWE, most recent first.
GHSA-C5CP-PF7W-RG5W
Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-02-06 18:31A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
{
"affected": [],
"aliases": [
"CVE-2024-57071"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T22:15:31Z",
"severity": "HIGH"
},
"details": "A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.",
"id": "GHSA-c5cp-pf7w-rg5w",
"modified": "2025-02-06T18:31:05Z",
"published": "2025-02-06T06:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57071"
},
{
"type": "WEB",
"url": "https://gist.github.com/tariqhawis/b56500d3a8866467ee769df7453eedaa"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C6H4-GC3F-HGJQ
Vulnerability from github – Published: 2022-01-06 21:58 – Updated: 2022-01-13 18:28All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "js-data"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23574"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-05T20:22:05Z",
"nvd_published_at": "2021-12-24T20:15:00Z",
"severity": "CRITICAL"
},
"details": "All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).",
"id": "GHSA-c6h4-gc3f-hgjq",
"modified": "2022-01-13T18:28:50Z",
"published": "2022-01-06T21:58:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23574"
},
{
"type": "WEB",
"url": "https://github.com/js-data/js-data/issues/576"
},
{
"type": "WEB",
"url": "https://github.com/js-data/js-data/issues/577"
},
{
"type": "PACKAGE",
"url": "https://github.com/js-data/js-data"
},
{
"type": "WEB",
"url": "https://github.com/js-data/js-data/blob/master/dist/js-data.js%23L472"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2320790"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2320791"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-JSDATA-1584361"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in js-data"
}
GHSA-C6RP-WRP9-QR4Q
Vulnerability from github – Published: 2022-12-21 21:30 – Updated: 2022-12-29 01:06A vulnerability was found in LinkedIn dustjs prior to version 3.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0 can address this issue. The name of the patch is ddb6523832465d38c9d80189e9de60519ac307c3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216464.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "dustjs-linkedin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-4264"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-74",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-22T03:35:37Z",
"nvd_published_at": "2022-12-21T19:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in LinkedIn dustjs prior to version 3.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0 can address this issue. The name of the patch is ddb6523832465d38c9d80189e9de60519ac307c3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216464.",
"id": "GHSA-c6rp-wrp9-qr4q",
"modified": "2022-12-29T01:06:38Z",
"published": "2022-12-21T21:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4264"
},
{
"type": "WEB",
"url": "https://github.com/linkedin/dustjs/issues/804"
},
{
"type": "WEB",
"url": "https://github.com/linkedin/dustjs/pull/805"
},
{
"type": "WEB",
"url": "https://github.com/linkedin/dustjs/commit/ddb6523832465d38c9d80189e9de60519ac307c3"
},
{
"type": "PACKAGE",
"url": "https://github.com/linkedin/dustjs"
},
{
"type": "WEB",
"url": "https://github.com/linkedin/dustjs/releases/tag/v3.0.0"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.216464"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.216464"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "dustjs-linkedin vulnerable to Prototype Pollution"
}
GHSA-C7M7-4257-H698
Vulnerability from github – Published: 2021-05-06 17:29 – Updated: 2021-05-05 21:29All versions of package templ8 up to and including 0.0.44 are vulnerable to Prototype Pollution via the parse function.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "templ8"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.44"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7702"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-05T21:29:36Z",
"nvd_published_at": "2020-08-17T14:15:00Z",
"severity": "CRITICAL"
},
"details": "All versions of package templ8 up to and including 0.0.44 are vulnerable to Prototype Pollution via the parse function.",
"id": "GHSA-c7m7-4257-h698",
"modified": "2021-05-05T21:29:36Z",
"published": "2021-05-06T17:29:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7702"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-TEMPL8-598770"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in templ8"
}
GHSA-C8XV-5998-G76H
Vulnerability from github – Published: 2026-05-14 16:17 – Updated: 2026-07-20 13:40Impact
An authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques this could lead to RCE on the instance.
Patches
The issue has been fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Disable the HTTP Request node by adding n8n-nodes-base.httpRequest to the NODES_EXCLUDE environment variable.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
n8n has adopted CVSS 4.0 as primary score for all security advisories. CVSS 3.1 vector strings are provided for backwards compatibility.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.123.43"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.21.0"
},
{
"fixed": "2.22.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-rc.0"
},
{
"fixed": "2.20.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44789"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T16:17:23Z",
"nvd_published_at": "2026-06-23T17:16:59Z",
"severity": "CRITICAL"
},
"details": "## Impact\nAn authenticated user with permission to create or modify workflows could achieve global prototype pollution via an unvalidated pagination parameter in the HTTP Request node. Combined with other techniques this could lead to RCE on the instance.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Disable the HTTP Request node by adding `n8n-nodes-base.httpRequest` to the `NODES_EXCLUDE` environment variable.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.\n\n---\nn8n has adopted CVSS 4.0 as primary score for all security advisories. CVSS 3.1 vector strings are provided for backwards compatibility.\n\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"id": "GHSA-c8xv-5998-g76h",
"modified": "2026-07-20T13:40:40Z",
"published": "2026-05-14T16:17:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-c8xv-5998-g76h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44789"
},
{
"type": "PACKAGE",
"url": "https://github.com/n8n-io/n8n"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "n8n: HTTP Request Node Pagination Prototype Pollution to RCE"
}
GHSA-C8XX-JPR5-7M25
Vulnerability from github – Published: 2026-07-21 06:31 – Updated: 2026-07-21 06:31Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto.
{
"affected": [],
"aliases": [
"CVE-2026-16266"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T06:16:28Z",
"severity": "MODERATE"
},
"details": "Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as __proto__.",
"id": "GHSA-c8xx-jpr5-7m25",
"modified": "2026-07-21T06:31:18Z",
"published": "2026-07-21T06:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16266"
},
{
"type": "WEB",
"url": "https://github.com/longshotlabs/mongo-object/issues/27"
},
{
"type": "WEB",
"url": "https://github.com/longshotlabs/mongo-object/commit/638314107d8b397e5453c28e41729522b3e8d67c"
},
{
"type": "WEB",
"url": "https://github.com/longshotlabs/mongo-object/blob/4f7a570f2a2fcfa9417b7870d5f859e9574ec73c/src/util.ts%23L251"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-MONGOOBJECT-13816714"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C96F-X56V-GQ3H
Vulnerability from github – Published: 2026-07-23 19:33 – Updated: 2026-07-23 19:33Impact
Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server.
The short version is that lookup() passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or __proto__ can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches currentNode.prefix.length.
Patches
Upgrade to v9.7.0.
Workarounds
Do not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.6.0"
},
"package": {
"ecosystem": "npm",
"name": "find-my-way"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47219"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-23T19:33:15Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nRemotely triggerable DoS in find-my-way when it is used with Node\u0027s HTTP/2 server.\n\nThe short version is that `lookup()` passes `req.method` into `find()`, and `find()` indexes `this.trees[method]`. Since `this.trees` is a normal object, HTTP/2 method values like constructor, `toString`, or `__proto__` can resolve inherited object properties instead of returning undefined. The code then treats that value like a router node and crashes when it reaches `currentNode.prefix.length`.\n\n### Patches\n\nUpgrade to v9.7.0.\n\n### Workarounds\n\nDo not use find-my-way with HTTP/2 servers, or validate that the http method is valid beforehand.",
"id": "GHSA-c96f-x56v-gq3h",
"modified": "2026-07-23T19:33:15Z",
"published": "2026-07-23T19:33:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/delvedor/find-my-way/security/advisories/GHSA-c96f-x56v-gq3h"
},
{
"type": "WEB",
"url": "https://github.com/delvedor/find-my-way/pull/434"
},
{
"type": "WEB",
"url": "https://github.com/delvedor/find-my-way/commit/cfe3fd6168b5ac1594c0820fb83fce251a533fc1"
},
{
"type": "PACKAGE",
"url": "https://github.com/delvedor/find-my-way"
},
{
"type": "WEB",
"url": "https://github.com/delvedor/find-my-way/releases/tag/v9.7.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "find-my-way: DDoS with HTTP2"
}
GHSA-CC8P-78QF-8P7Q
Vulnerability from github – Published: 2025-09-24 21:30 – Updated: 2025-09-26 18:31A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution vulnerabilities by injecting malicious input values (e.g., "proto"), enabling unauthorized modification of the JavaScript Object prototype chain. Successful exploitation could lead to denial of service conditions, unexpected application behavior, or potential execution of arbitrary code in contexts where polluted properties are later accessed or executed. The issue affects versions prior to 7.0.11 and remains unpatched at the time of disclosure.
{
"affected": [],
"aliases": [
"CVE-2025-57347"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-24T19:15:39Z",
"severity": "CRITICAL"
},
"details": "A vulnerability exists in the \u0027dagre-d3-es\u0027 Node.js package version 7.0.9, specifically within the \u0027bk\u0027 module\u0027s addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution vulnerabilities by injecting malicious input values (e.g., \"__proto__\"), enabling unauthorized modification of the JavaScript Object prototype chain. Successful exploitation could lead to denial of service conditions, unexpected application behavior, or potential execution of arbitrary code in contexts where polluted properties are later accessed or executed. The issue affects versions prior to 7.0.11 and remains unpatched at the time of disclosure.",
"id": "GHSA-cc8p-78qf-8p7q",
"modified": "2025-09-26T18:31:19Z",
"published": "2025-09-24T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57347"
},
{
"type": "WEB",
"url": "https://github.com/tbo47/dagre-es/issues/52"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57347"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CFGR-75JX-H88G
Vulnerability from github – Published: 2022-10-31 19:00 – Updated: 2024-04-22 23:20Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.8.15"
},
"package": {
"ecosystem": "npm",
"name": "browserify-shim"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-37623"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:20:54Z",
"nvd_published_at": "2022-10-31T12:15:00Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.",
"id": "GHSA-cfgr-75jx-h88g",
"modified": "2024-04-22T23:20:54Z",
"published": "2022-10-31T19:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37623"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/issues/248"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/pull/246"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/commit/97855e622b6dcd117c77e6583701962ff45e7338"
},
{
"type": "PACKAGE",
"url": "https://github.com/thlorenz/browserify-shim"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L94"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "thlorenz browserify-shim vulnerable to prototype pollution"
}
GHSA-CFW5-2VXH-HR84
Vulnerability from github – Published: 2026-03-12 14:13 – Updated: 2026-03-12 14:13In devalue v5.6.3, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "devalue"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.6.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-30226"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-12T14:13:03Z",
"nvd_published_at": "2026-03-11T18:16:22Z",
"severity": "MODERATE"
},
"details": "In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.",
"id": "GHSA-cfw5-2vxh-hr84",
"modified": "2026-03-12T14:13:03Z",
"published": "2026-03-12T14:13:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30226"
},
{
"type": "PACKAGE",
"url": "https://github.com/sveltejs/devalue"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "devalue has prototype pollution in devalue.parse and devalue.unflatten"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.