CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
852 vulnerabilities reference this CWE, most recent first.
GHSA-R5CQ-9537-9RPF
Vulnerability from github – Published: 2022-02-10 23:52 – Updated: 2021-12-13 21:33Node.js mixme 0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mixme"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-28860"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-19T21:34:53Z",
"nvd_published_at": "2021-05-03T12:15:00Z",
"severity": "CRITICAL"
},
"details": "Node.js mixme 0.5.0, an attacker can add or alter properties of an object via \u0027__proto__\u0027 through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).",
"id": "GHSA-r5cq-9537-9rpf",
"modified": "2021-12-13T21:33:52Z",
"published": "2022-02-10T23:52:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28860"
},
{
"type": "WEB",
"url": "https://github.com/adaltas/node-mixme/issues/1"
},
{
"type": "WEB",
"url": "https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028"
},
{
"type": "PACKAGE",
"url": "https://github.com/adaltas/node-mixme"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210618-0005"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/~david"
},
{
"type": "WEB",
"url": "http://nodejs.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in mixme"
}
GHSA-R5MX-6WC6-7H9W
Vulnerability from github – Published: 2026-02-26 19:54 – Updated: 2026-02-26 19:54Summary
dottie versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit 7d3aee1 only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing __proto__ at any position other than the first.
Both dottie.set() and dottie.transform() are affected.
Details
The existing guard checks only pieces[0] === '__proto__'. When a path like 'a.__proto__.polluted' is used, pieces[0] evaluates to 'a', not '__proto__', so the guard is bypassed.
Inside the traversal loop, current['__proto__'] = {} triggers the __proto__ setter, replacing the intermediate object's prototype. The final value is then written onto this new prototype.
Important distinction: This vulnerability does NOT pollute the global Object.prototype. It injects properties into a specific object's prototype chain. However, injected properties are invisible to hasOwnProperty() and Object.keys(), which makes them difficult to detect and can lead to authorization bypass in common coding patterns.
PoC
const dottie = require('dottie');
// set() bypass
const obj = {};
dottie.set(obj, 'session.__proto__.isAdmin', true);
console.log(obj.session.isAdmin); // true
console.log(({}).isAdmin); // undefined
console.log(obj.session.hasOwnProperty('isAdmin')); // false
// transform() bypass
const flat = { 'user.__proto__.role': 'admin', 'user.name': 'guest' };
const result = dottie.transform(flat);
console.log(result.user.role); // 'admin'
console.log(({}).role); // undefined
Tested on Node.js v20 and v22, dottie 2.0.6, Windows 11.
Impact
The primary risk is authorization bypass. In a typical server-side scenario where dottie is used to process user input (e.g., via Sequelize, which depends on dottie with ~1.3M weekly npm downloads), an attacker can inject properties like isAdmin: true into objects used for access control decisions. Since the injected property is not an own property, standard checks using hasOwnProperty() or Object.keys() will not reveal it, while property access like if (session.isAdmin) will return true.
Additionally, replacing an object's prototype via current['__proto__'] = {} strips all inherited methods, potentially causing TypeError exceptions and denial of service.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.6"
},
"package": {
"ecosystem": "npm",
"name": "dottie"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.4"
},
{
"fixed": "2.0.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-27837"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-26T19:54:34Z",
"nvd_published_at": "2026-02-26T01:16:24Z",
"severity": "MODERATE"
},
"details": "### Summary\n\ndottie versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first.\n\nBoth `dottie.set()` and `dottie.transform()` are affected.\n\n### Details\n\nThe existing guard checks only `pieces[0] === \u0027__proto__\u0027`. When a path like `\u0027a.__proto__.polluted\u0027` is used, `pieces[0]` evaluates to `\u0027a\u0027`, not `\u0027__proto__\u0027`, so the guard is bypassed.\n\nInside the traversal loop, `current[\u0027__proto__\u0027] = {}` triggers the `__proto__` setter, replacing the intermediate object\u0027s prototype. The final value is then written onto this new prototype.\n\n**Important distinction:** This vulnerability does NOT pollute the global `Object.prototype`. It injects properties into a specific object\u0027s prototype chain. However, injected properties are invisible to `hasOwnProperty()` and `Object.keys()`, which makes them difficult to detect and can lead to authorization bypass in common coding patterns.\n\n### PoC\n```javascript\nconst dottie = require(\u0027dottie\u0027);\n\n// set() bypass\nconst obj = {};\ndottie.set(obj, \u0027session.__proto__.isAdmin\u0027, true);\nconsole.log(obj.session.isAdmin); // true\nconsole.log(({}).isAdmin); // undefined\nconsole.log(obj.session.hasOwnProperty(\u0027isAdmin\u0027)); // false\n\n// transform() bypass\nconst flat = { \u0027user.__proto__.role\u0027: \u0027admin\u0027, \u0027user.name\u0027: \u0027guest\u0027 };\nconst result = dottie.transform(flat);\nconsole.log(result.user.role); // \u0027admin\u0027\nconsole.log(({}).role); // undefined\n```\n\nTested on Node.js v20 and v22, dottie 2.0.6, Windows 11.\n\n### Impact\n\nThe primary risk is authorization bypass. In a typical server-side scenario where dottie is used to process user input (e.g., via Sequelize, which depends on dottie with ~1.3M weekly npm downloads), an attacker can inject properties like `isAdmin: true` into objects used for access control decisions. Since the injected property is not an own property, standard checks using `hasOwnProperty()` or `Object.keys()` will not reveal it, while property access like `if (session.isAdmin)` will return `true`.\n\nAdditionally, replacing an object\u0027s prototype via `current[\u0027__proto__\u0027] = {}` strips all inherited methods, potentially causing TypeError exceptions and denial of service.",
"id": "GHSA-r5mx-6wc6-7h9w",
"modified": "2026-02-26T19:54:34Z",
"published": "2026-02-26T19:54:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27837"
},
{
"type": "WEB",
"url": "https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-4gxf-g5gf-22h4"
},
{
"type": "PACKAGE",
"url": "https://github.com/mickhansen/dottie.js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()"
}
GHSA-R659-8XFP-J327
Vulnerability from github – Published: 2021-09-07 23:09 – Updated: 2023-09-07 18:40objection.js prior to version 2.2.16 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). This issue is patched in version 2.2.16.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "objection"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3766"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-07T19:01:54Z",
"nvd_published_at": "2021-09-06T12:15:00Z",
"severity": "CRITICAL"
},
"details": "objection.js prior to version 2.2.16 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027). This issue is patched in version 2.2.16.",
"id": "GHSA-r659-8xfp-j327",
"modified": "2023-09-07T18:40:01Z",
"published": "2021-09-07T23:09:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3766"
},
{
"type": "WEB",
"url": "https://github.com/Vincit/objection.js/commit/46b842a6bc897198b83f41ac85c92864b991d7e9"
},
{
"type": "WEB",
"url": "https://github.com/vincit/objection.js/commit/b41aab8dcd78f426f7468dcda541a7aca18a66a6"
},
{
"type": "PACKAGE",
"url": "https://github.com/vincit/objection.js"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/c98e0f0e-ebf2-4072-be73-a1848ea031cc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "objection.js Prototype Pollution vulnerability"
}
GHSA-R6RJ-9CH6-G264
Vulnerability from github – Published: 2021-06-07 22:09 – Updated: 2021-06-16 19:58The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "merge-deep"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-26707"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-03T21:48:51Z",
"nvd_published_at": "2021-06-02T15:15:00Z",
"severity": "CRITICAL"
},
"details": "The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.",
"id": "GHSA-r6rj-9ch6-g264",
"modified": "2021-06-16T19:58:45Z",
"published": "2021-06-07T22:09:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26707"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/merge-deep/commit/11e5dd56de8a6aed0b1ed022089dbce6968d82a5"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210716-0008"
},
{
"type": "ADVISORY",
"url": "https://securitylab.github.com/advisories/GHSL-2020-160-merge-deep"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/merge-deep"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution in Merge-deep"
}
GHSA-R737-347M-WQC7
Vulnerability from github – Published: 2022-10-29 12:00 – Updated: 2024-04-22 23:20Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.8.15"
},
"package": {
"ecosystem": "npm",
"name": "browserify-shim"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-37621"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:20:55Z",
"nvd_published_at": "2022-10-28T20:15:00Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.",
"id": "GHSA-r737-347m-wqc7",
"modified": "2024-04-22T23:20:55Z",
"published": "2022-10-29T12:00:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37621"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/issues/247"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/pull/246"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/commit/97855e622b6dcd117c77e6583701962ff45e7338"
},
{
"type": "PACKAGE",
"url": "https://github.com/thlorenz/browserify-shim"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158"
},
{
"type": "WEB",
"url": "https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L37"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "thlorenz browserify-shim vulnerable to prototype pollution"
}
GHSA-R738-3H9R-FPVV
Vulnerability from github – Published: 2023-10-20 18:30 – Updated: 2024-04-04 08:51The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
{
"affected": [],
"aliases": [
"CVE-2023-3962"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-79"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-20T16:15:19Z",
"severity": "MODERATE"
},
"details": "The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
"id": "GHSA-r738-3h9r-fpvv",
"modified": "2024-04-04T08:51:26Z",
"published": "2023-10-20T18:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3962"
},
{
"type": "WEB",
"url": "https://github.com/BlackFan/client-side-prototype-pollution"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8b75a1-f0f2-445b-a1c7-1628916470d3?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R7JX-5M6M-CPG9
Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-04-07 12:34A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.
Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., child_process.exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.
Proof of Concept
(async () => {
const lib = await import('eazy-logger');
var someObj = {}
console.log("Before Attack: ", JSON.stringify({}.__proto__));
try {
// for multiple functions, uncomment only one for each execution.
lib.Logger (JSON.parse('{"__proto__":{"pollutedKey":123}}'))
} catch (e) { }
console.log("After Attack: ", JSON.stringify({}.__proto__));
delete Object.prototype.pollutedKey;
})();
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.0.1"
},
"package": {
"ecosystem": "npm",
"name": "eazy-logger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-57075"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-06T23:31:34Z",
"nvd_published_at": "2025-02-05T22:15:31Z",
"severity": "HIGH"
},
"details": "A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.\n\nAn attacker can supply a payload with `Object.prototype` setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., `child_process.exec`, `eval`), it could enable an attacker to execute arbitrary commands within the application\u0027s context.\n\n## Proof of Concept\n\n```js\n(async () =\u003e {\nconst lib = await import(\u0027eazy-logger\u0027);\nvar someObj = {}\nconsole.log(\"Before Attack: \", JSON.stringify({}.__proto__));\ntry {\n// for multiple functions, uncomment only one for each execution.\nlib.Logger (JSON.parse(\u0027{\"__proto__\":{\"pollutedKey\":123}}\u0027))\n} catch (e) { }\nconsole.log(\"After Attack: \", JSON.stringify({}.__proto__));\ndelete Object.prototype.pollutedKey;\n})();\n```",
"id": "GHSA-r7jx-5m6m-cpg9",
"modified": "2025-04-07T12:34:01Z",
"published": "2025-02-06T06:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57075"
},
{
"type": "WEB",
"url": "https://github.com/shakyShane/eazy-logger/commit/a8baa6fe441d19ffa9916eba367016b7937a28fd"
},
{
"type": "WEB",
"url": "https://gist.github.com/tariqhawis/c601f7f85146510ca899a7406a03aba5"
},
{
"type": "PACKAGE",
"url": "https://github.com/shakyShane/eazy-logger"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "eazy-logger prototype pollution"
}
GHSA-R8C2-2QWQ-94P6
Vulnerability from github – Published: 2025-10-20 15:33 – Updated: 2025-10-20 15:33Impact
Prototype pollution potential with the utility function rollbar/src/utility.set(). No impact when using the published public interface.
If application code directly imports set from rollbar/src/utility and then calls set with untrusted input in the second argument, it is vulnerable to prototype pollution.
POC:
const obj = {};
require("rollbar/src/utility").set(obj, "__proto__.polluted", "vulnerable");
console.log({}.polluted !== undefined ? '[POLLUTION_TRIGGERED]':'');
Patches
Fixed in version 2.26.5 and 3.0.0-beta5.
Workarounds
If application code directly imports set from rollbar/src/utility, ensure that the second argument does not receive untrusted input.
References
https://github.com/rollbar/rollbar.js/issues/1333#issuecomment-3353720946
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.26.4"
},
"package": {
"ecosystem": "npm",
"name": "rollbar"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.26.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.0-beta4"
},
"package": {
"ecosystem": "npm",
"name": "rollbar"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0-alpha1"
},
{
"fixed": "3.0.0-beta5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-57325"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-20T15:33:02Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Impact\n\nPrototype pollution potential with the utility function `rollbar/src/utility`.`set()`. No impact when using the published public interface.\n\nIf application code directly imports `set` from `rollbar/src/utility` and then calls `set` with untrusted input in the second argument, it is vulnerable to prototype pollution.\n\nPOC:\n\n```js\nconst obj = {};\nrequire(\"rollbar/src/utility\").set(obj, \"__proto__.polluted\", \"vulnerable\");\nconsole.log({}.polluted !== undefined ? \u0027[POLLUTION_TRIGGERED]\u0027:\u0027\u0027);\n```\n\n### Patches\n\nFixed in version 2.26.5 and 3.0.0-beta5.\n\n### Workarounds\n\nIf application code directly imports `set` from `rollbar/src/utility`, ensure that the second argument does not receive untrusted input.\n\n### References\n\nhttps://github.com/rollbar/rollbar.js/issues/1333#issuecomment-3353720946",
"id": "GHSA-r8c2-2qwq-94p6",
"modified": "2025-10-20T15:33:02Z",
"published": "2025-10-20T15:33:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rollbar/rollbar.js/security/advisories/GHSA-r8c2-2qwq-94p6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57325"
},
{
"type": "WEB",
"url": "https://github.com/rollbar/rollbar.js/issues/1333"
},
{
"type": "WEB",
"url": "https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/rollbar%402.26.4/index.js"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57325"
},
{
"type": "PACKAGE",
"url": "https://github.com/rollbar/rollbar.js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "rollbar vulnerable to prototype pollution"
}
GHSA-R96X-P6V3-J823
Vulnerability from github – Published: 2025-03-05 12:31 – Updated: 2025-04-02 18:30Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors
{
"affected": [],
"aliases": [
"CVE-2025-25015"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-05T10:15:20Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests.\nIn Kibana versions \u003e= 8.15.0 and \u003c 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors",
"id": "GHSA-r96x-p6v3-j823",
"modified": "2025-04-02T18:30:48Z",
"published": "2025-03-05T12:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25015"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/kibana-8-17-3-8-16-6-security-update-esa-2025-06/375441"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/kibana-8-17-3-security-update-esa-2025-06/375441"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R9W3-G83Q-M6HQ
Vulnerability from github – Published: 2022-04-01 17:26 – Updated: 2022-04-13 16:28deepmerge-ts is used to merge 2 or more objects respecting type information. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). A fix was released in version 4.0.2. Currently, there is no known workaround.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "deepmerge-ts"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24802"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-01T17:26:03Z",
"nvd_published_at": "2022-04-01T00:15:00Z",
"severity": "HIGH"
},
"details": "deepmerge-ts is used to merge 2 or more objects respecting type information. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). A fix was released in version 4.0.2. Currently, there is no known workaround.",
"id": "GHSA-r9w3-g83q-m6hq",
"modified": "2022-04-13T16:28:10Z",
"published": "2022-04-01T17:26:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-r9w3-g83q-m6hq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24802"
},
{
"type": "WEB",
"url": "https://github.com/RebeccaStevens/deepmerge-ts/commit/b39f1a93d9e1c3541bd2fe159fd696a16dbe1c72"
},
{
"type": "WEB",
"url": "https://github.com/RebeccaStevens/deepmerge-ts/commit/d637db7e4fb2bfb113cb4bc1c85a125936d7081b"
},
{
"type": "PACKAGE",
"url": "https://github.com/RebeccaStevens/deepmerge-ts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in deepmerge-ts"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.