CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
954 vulnerabilities reference this CWE, most recent first.
GHSA-GCGF-FH7C-8GF2
Vulnerability from github – Published: 2026-10-05 17:32 – Updated: 2026-10-05 17:32Summary
ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can:
- replace the prototype of the coerced input object, and
- make a request fail with an unhandled
TypeErrorby sending a key such asconstructor.
This is the same class of bug as GHSA-4h5r-cv8j-4456 in @orpc/json-schema, in a different package.
This is not global prototype pollution
The global Object.prototype is never modified. No shared or global state is written, so other objects in the process, other requests, and other users are not affected.
What changes is the prototype of one object: the value the coercer returns for the request that carried the payload. That object is passed on to validation and to the procedure handler, then discarded when the request ends. An ordinary {} created anywhere else in the application is unaffected.
Details
1. __proto__ replaces the prototype of the coerced value
Coerced properties were collected into a plain {}, so newObj['__proto__'] = value triggers the inherited __proto__ setter instead of creating an own property. Verified on 1.14.8 against a record schema, in both plugins:
schema: z.record(z.string())
input: {"a":"1","__proto__":{"polluted":true}}
Object.keys(result) => ["a"] // the __proto__ entry is dropped from the output
result.polluted => true // the attacker object is now this object's prototype
({}).polluted => undefined // Object.prototype is untouched
The returned value inherits attacker controlled properties, and any consumer reading them through the prototype chain, such as a handler checking input.isAdmin, an Object.assign copy, or a config lookup, sees data the client never legitimately supplied. How far that goes depends on what the application does with the coerced input. There is no generic escalation path.
This affects the record branch of both plugins, and the object branch of both plugins for any key that does not first trigger the error below.
2. Sub-schemas resolved through the prototype chain
The object branch looked up sub-schemas with shape[key], which returns inherited members for keys such as constructor, toString and __proto__. Those values, for example the Object constructor, were then dereferenced as Zod schemas:
schema: z.object({ a: z.number() })
input: { a: '123', constructor: '456' }
zod 3 => TypeError: Cannot read properties of undefined (reading 'Symbol(ORPC_CUSTOM_ZOD_DEF)')
zod 4 => TypeError: Cannot read properties of undefined (reading 'def')
Coercion throws before the assignment, so for object schemas these keys break the request rather than injecting a prototype. Any client can trigger this on its own requests. It does not affect other clients or the process as a whole.
Impact
Any oRPC server that installs ZodSmartCoercionPlugin or experimental_ZodSmartCoercionPlugin from @orpc/zod and has at least one procedure whose input schema contains an object or a record. No authentication or user interaction is required beyond what the procedure itself demands.
The effect is scoped to the request that sent the payload. Because no global state is written, one request cannot influence another, and restarting the process is not needed to recover.
Patch
Fixed in 1.14.10.
In packages/zod/src/coercer.ts and packages/zod/src/zod4/coercer.ts:
- collect coerced object and record properties into
NullProtoObj, the null prototype helper already used for untrusted keys inbracket-notation.tsandrpc-matcher.ts, so__proto__stays an ordinary own property and is preserved in the output - guard the shape lookup with
Object.hasOwn, so unknown keys fall through tocatchallas they already do for every other name
PR: middleapi/orpc#1727
Workarounds
Reject or strip request payloads containing __proto__, constructor or prototype keys before they reach the handler, or remove the plugin if automatic coercion is not required.
Note that SmartCoercionPlugin from @orpc/json-schema, the recommended replacement for these plugins, was affected by the same class of issue (GHSA-4h5r-cv8j-4456) and is fixed in the same release.
Credit
Reported and fixed internally.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@orpc/zod"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-103918"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T17:32:32Z",
"nvd_published_at": "2026-10-02T20:17:00Z",
"severity": "MODERATE"
},
"details": "## Summary\n\n`ZodSmartCoercionPlugin` and `experimental_ZodSmartCoercionPlugin` mishandle object keys that name `Object.prototype` members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can:\n\n1. replace the prototype of the coerced input object, and\n2. make a request fail with an unhandled `TypeError` by sending a key such as `constructor`.\n\nThis is the same class of bug as GHSA-4h5r-cv8j-4456 in `@orpc/json-schema`, in a different package.\n\n## This is not global prototype pollution\n\n**The global `Object.prototype` is never modified.** No shared or global state is written, so other objects in the process, other requests, and other users are not affected.\n\nWhat changes is the prototype of one object: the value the coercer returns for the request that carried the payload. That object is passed on to validation and to the procedure handler, then discarded when the request ends. An ordinary `{}` created anywhere else in the application is unaffected.\n\n## Details\n\n### 1. `__proto__` replaces the prototype of the coerced value\n\nCoerced properties were collected into a plain `{}`, so `newObj[\u0027__proto__\u0027] = value` triggers the inherited `__proto__` setter instead of creating an own property. Verified on 1.14.8 against a record schema, in both plugins:\n\n```\nschema: z.record(z.string())\ninput: {\"a\":\"1\",\"__proto__\":{\"polluted\":true}}\n\nObject.keys(result) =\u003e [\"a\"] // the __proto__ entry is dropped from the output\nresult.polluted =\u003e true // the attacker object is now this object\u0027s prototype\n({}).polluted =\u003e undefined // Object.prototype is untouched\n```\n\nThe returned value inherits attacker controlled properties, and any consumer reading them through the prototype chain, such as a handler checking `input.isAdmin`, an `Object.assign` copy, or a config lookup, sees data the client never legitimately supplied. How far that goes depends on what the application does with the coerced input. There is no generic escalation path.\n\nThis affects the `record` branch of both plugins, and the `object` branch of both plugins for any key that does not first trigger the error below.\n\n### 2. Sub-schemas resolved through the prototype chain\n\nThe `object` branch looked up sub-schemas with `shape[key]`, which returns inherited members for keys such as `constructor`, `toString` and `__proto__`. Those values, for example the `Object` constructor, were then dereferenced as Zod schemas:\n\n```\nschema: z.object({ a: z.number() })\ninput: { a: \u0027123\u0027, constructor: \u0027456\u0027 }\n\nzod 3 =\u003e TypeError: Cannot read properties of undefined (reading \u0027Symbol(ORPC_CUSTOM_ZOD_DEF)\u0027)\nzod 4 =\u003e TypeError: Cannot read properties of undefined (reading \u0027def\u0027)\n```\n\nCoercion throws before the assignment, so for object schemas these keys break the request rather than injecting a prototype. Any client can trigger this on its own requests. It does not affect other clients or the process as a whole.\n\n## Impact\n\nAny oRPC server that installs `ZodSmartCoercionPlugin` or `experimental_ZodSmartCoercionPlugin` from `@orpc/zod` and has at least one procedure whose input schema contains an object or a record. No authentication or user interaction is required beyond what the procedure itself demands.\n\nThe effect is scoped to the request that sent the payload. Because no global state is written, one request cannot influence another, and restarting the process is not needed to recover.\n\n## Patch\n\nFixed in 1.14.10.\n\nIn `packages/zod/src/coercer.ts` and `packages/zod/src/zod4/coercer.ts`:\n\n- collect coerced object and record properties into `NullProtoObj`, the null prototype helper already used for untrusted keys in `bracket-notation.ts` and `rpc-matcher.ts`, so `__proto__` stays an ordinary own property and is preserved in the output\n- guard the shape lookup with `Object.hasOwn`, so unknown keys fall through to `catchall` as they already do for every other name\n\nPR: middleapi/orpc#1727\n\n## Workarounds\n\nReject or strip request payloads containing `__proto__`, `constructor` or `prototype` keys before they reach the handler, or remove the plugin if automatic coercion is not required.\n\nNote that `SmartCoercionPlugin` from `@orpc/json-schema`, the recommended replacement for these plugins, was affected by the same class of issue (GHSA-4h5r-cv8j-4456) and is fixed in the same release.\n\n## Credit\n\nReported and fixed internally.",
"id": "GHSA-gcgf-fh7c-8gf2",
"modified": "2026-10-05T17:32:32Z",
"published": "2026-10-05T17:32:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103918"
},
{
"type": "WEB",
"url": "https://github.com/middleapi/orpc/pull/1727"
},
{
"type": "WEB",
"url": "https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570"
},
{
"type": "PACKAGE",
"url": "https://github.com/middleapi/orpc"
},
{
"type": "WEB",
"url": "https://github.com/middleapi/orpc/releases/tag/v1.14.10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "@orpc/zod: Prototype injection in smart coercion"
}
GHSA-GCQX-W48M-W2H4
Vulnerability from github – Published: 2026-09-18 18:31 – Updated: 2026-09-18 18:31deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.
{
"affected": [],
"aliases": [
"CVE-2026-93753"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-18T18:18:34Z",
"severity": "HIGH"
},
"details": "deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object\u0027s prototype, causing applications to inherit unintended values when accessing properties without own-property checks.",
"id": "GHSA-gcqx-w48m-w2h4",
"modified": "2026-09-18T18:31:44Z",
"published": "2026-09-18T18:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93753"
},
{
"type": "WEB",
"url": "https://github.com/TehShrike/deepmerge/issues/273"
},
{
"type": "WEB",
"url": "https://github.com/TehShrike/deepmerge"
},
{
"type": "WEB",
"url": "https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GCX5-3P5F-F8VP
Vulnerability from github – Published: 2022-03-03 00:00 – Updated: 2022-03-10 15:53jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "jquery.cookie"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-23395"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-03T19:16:20Z",
"nvd_published_at": "2022-03-02T12:15:00Z",
"severity": "MODERATE"
},
"details": "jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).",
"id": "GHSA-gcx5-3p5f-f8vp",
"modified": "2022-03-10T15:53:25Z",
"published": "2022-03-03T00:00:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23395"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220325-0008"
},
{
"type": "WEB",
"url": "https://snyk.io/test/npm/jquery.cookie/1.4.1?tab=issues"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in jquery.cookie"
}
GHSA-GFF7-G5R8-MG8M
Vulnerability from github – Published: 2022-03-23 00:00 – Updated: 2022-03-29 13:08simple-plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "simple-plist"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-26260"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-29T13:08:19Z",
"nvd_published_at": "2022-03-22T19:15:00Z",
"severity": "CRITICAL"
},
"details": "simple-plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().",
"id": "GHSA-gff7-g5r8-mg8m",
"modified": "2022-03-29T13:08:19Z",
"published": "2022-03-23T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26260"
},
{
"type": "WEB",
"url": "https://github.com/wollardj/simple-plist/issues/60"
},
{
"type": "WEB",
"url": "https://github.com/wollardj/simple-plist/issues/60#issuecomment-1083991840"
},
{
"type": "WEB",
"url": "https://github.com/wollardj/simple-plist/commit/670e22fd6e46549a1d32d1065981e0f58eab98d6"
},
{
"type": "PACKAGE",
"url": "https://github.com/wollardj/simple-plist"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in simple-plist"
}
GHSA-GG4H-3HG2-GRPC
Vulnerability from github – Published: 2026-09-08 20:51 – Updated: 2026-09-08 20:51Impact
Applications are affected only if a schema renames keys with a regular-expression source and a Joi.expression() / Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, for example .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true }). Because the target is rendered from the matched input key, an attacker who controls input keys can send x-__proto__ with an object value and make the rename target render as __proto__, which sets the prototype of the object joi returns instead of creating a key on it. The global Object.prototype is not modified, so the effect is confined to the object returned by that one validate() call.
Schemas using a static string rename target are not affected, and neither are schemas left on the default { multiple: false }.
Patches
Versions 17.13.5 and 18.2.4 have been released to address the issue.
Workarounds
- Replace the template rename target with a static string target.
- Keep the template but make the capture unable to produce
__proto__, using a negative lookahead:.rename(/^x-(?!__proto__$)(.+)$/, Joi.x('{#1}'), { multiple: true }) - Drop { multiple: true } from the rename, which stops the rename before the assignment.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "joi"
},
"ranges": [
{
"events": [
{
"introduced": "16.0.0"
},
{
"fixed": "17.13.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "joi"
},
"ranges": [
{
"events": [
{
"introduced": "18.0.0"
},
{
"fixed": "18.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-84367"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-08T20:51:21Z",
"nvd_published_at": "2026-09-01T21:18:47Z",
"severity": "LOW"
},
"details": "### Impact\n\nApplications are affected only if a schema renames keys with a regular-expression source and a `Joi.expression()` / `Joi.x()` target that interpolates the pattern\u0027s own match data, combined with `{ multiple: true }`, for example `.rename(/^x-(.+)$/, Joi.x(\u0027{#1}\u0027), { multiple: true })`. Because the target is rendered from the matched input key, an attacker who controls input keys can send `x-__proto__` with an object value and make the rename target render as `__proto__`, which sets the prototype of the object joi returns instead of creating a key on it. The global `Object.prototype` is not modified, so the effect is confined to the object returned by that one `validate()` call.\n\nSchemas using a static string rename target are not affected, and neither are schemas left on the default `{ multiple: false }`.\n\n### Patches\n\nVersions 17.13.5 and 18.2.4 have been released to address the issue.\n\n### Workarounds\n\n1. Replace the template rename target with a static string target.\n2. Keep the template but make the capture unable to produce `__proto__`, using a negative lookahead: `.rename(/^x-(?!__proto__$)(.+)$/, Joi.x(\u0027{#1}\u0027), { multiple: true })`\n3. Drop { multiple: true } from the rename, which stops the rename before the assignment.",
"id": "GHSA-gg4h-3hg2-grpc",
"modified": "2026-09-08T20:51:21Z",
"published": "2026-09-08T20:51:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84367"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/pull/3134"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/pull/3135"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01"
},
{
"type": "PACKAGE",
"url": "https://github.com/hapijs/joi"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/releases/tag/v17.13.5"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/releases/tag/v18.2.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "joi: object().rename() with a template target can set the validated object\u0027s prototype"
}
GHSA-GH4X-QV3P-M9PM
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-05 17:41akbr patch-into version 1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@akbr/patch-into"
},
"versions": [
"1.0.1"
]
}
],
"aliases": [
"CVE-2024-38991"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-01T21:30:34Z",
"nvd_published_at": "2024-07-01T13:15:04Z",
"severity": "HIGH"
},
"details": "akbr patch-into version 1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
"id": "GHSA-gh4x-qv3p-m9pm",
"modified": "2024-07-05T17:41:35Z",
"published": "2024-07-01T15:32:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38991"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/8851413e3b33a96f191f0e9c81706532"
},
{
"type": "PACKAGE",
"url": "github.com/akbr/patch-into"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "akbr patch-into was discovered to contain a prototype pollution via the function patchInto"
}
GHSA-GHGH-MC9F-W47R
Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-02-06 18:31A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
{
"affected": [],
"aliases": [
"CVE-2024-57069"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T22:15:31Z",
"severity": "HIGH"
},
"details": "A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.",
"id": "GHSA-ghgh-mc9f-w47r",
"modified": "2025-02-06T18:31:05Z",
"published": "2025-02-06T06:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57069"
},
{
"type": "WEB",
"url": "https://gist.github.com/tariqhawis/68e06b00e3258d0d427257c6906bd300"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GHR5-CH3P-VCR6
Vulnerability from github – Published: 2024-04-28 18:30 – Updated: 2024-08-02 15:45The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "ejs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-33883"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-693"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-01T08:25:03Z",
"nvd_published_at": "2024-04-28T16:15:23Z",
"severity": "MODERATE"
},
"details": "The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.",
"id": "GHSA-ghr5-ch3p-vcr6",
"modified": "2024-08-02T15:45:51Z",
"published": "2024-04-28T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33883"
},
{
"type": "WEB",
"url": "https://github.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5"
},
{
"type": "PACKAGE",
"url": "https://github.com/mde/ejs"
},
{
"type": "WEB",
"url": "https://github.com/mde/ejs/compare/v3.1.9...v3.1.10"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240605-0003"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ejs lacks certain pollution protection"
}
GHSA-GJM5-83CW-P3P2
Vulnerability from github – Published: 2022-01-12 22:59 – Updated: 2022-01-11 18:11The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "extend2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23568"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-11T18:11:48Z",
"nvd_published_at": "2022-01-10T14:10:00Z",
"severity": "HIGH"
},
"details": "The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.",
"id": "GHSA-gjm5-83cw-p3p2",
"modified": "2022-01-11T18:11:48Z",
"published": "2022-01-12T22:59:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23568"
},
{
"type": "WEB",
"url": "https://github.com/eggjs/extend2/pull/2"
},
{
"type": "WEB",
"url": "https://github.com/eggjs/extend2/commit/aa332a59116c8398976434b57ea477c6823054f8"
},
{
"type": "PACKAGE",
"url": "https://github.com/eggjs/extend2"
},
{
"type": "WEB",
"url": "https://github.com/eggjs/extend2/blob/master/index.js%23L50-L60"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-EXTEND2-2320315"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in extend2"
}
GHSA-GM2V-MF3R-56JR
Vulnerability from github – Published: 2024-06-17 15:30 – Updated: 2024-07-03 18:45A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index.
{
"affected": [],
"aliases": [
"CVE-2024-36583"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-17T14:15:10Z",
"severity": "HIGH"
},
"details": "A Prototype Pollution issue in byondreal accessor \u003c= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index.",
"id": "GHSA-gm2v-mf3r-56jr",
"modified": "2024-07-03T18:45:36Z",
"published": "2024-06-17T15:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36583"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/97bc2fbfbcbde3a54d5536c9adeee34c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.