CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
852 vulnerabilities reference this CWE, most recent first.
GHSA-VCQH-932G-M3QJ
Vulnerability from github – Published: 2026-04-11 09:30 – Updated: 2026-04-13 18:30Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2026-34621"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-11T07:16:03Z",
"severity": "CRITICAL"
},
"details": "Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-vcqh-932g-m3qj",
"modified": "2026-04-13T18:30:38Z",
"published": "2026-04-11T09:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34621"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb26-43.html"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34621"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VG34-HPFQ-M5QM
Vulnerability from github – Published: 2026-08-11 15:32 – Updated: 2026-08-11 15:32n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.
{
"affected": [],
"aliases": [
"CVE-2026-72749"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T13:19:05Z",
"severity": "HIGH"
},
"details": "n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method path and corrupt a shared global in the main Node.js process. Because that global is used on the request-authentication path, the instance then fails every authenticated request, causing an instance-wide denial of service for all users until the process is restarted.",
"id": "GHSA-vg34-hpfq-m5qm",
"modified": "2026-08-11T15:32:37Z",
"published": "2026-08-11T15:32:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-xwx6-jjhv-84p8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72749"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-prototype-pollution-via-edit-fields"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VG6V-JCG3-5MP7
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-11 17:43aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@aofl/cli-lib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.0.0-alpha.45"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-38987"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-11T17:43:35Z",
"nvd_published_at": "2024-07-01T13:15:04Z",
"severity": "MODERATE"
},
"details": "aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
"id": "GHSA-vg6v-jcg3-5mp7",
"modified": "2024-07-11T17:43:35Z",
"published": "2024-07-01T15:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38987"
},
{
"type": "WEB",
"url": "https://github.com/AgeOfLearning/aofl/issues/35"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/29636943e6989e67f38251580cbcea73"
},
{
"type": "PACKAGE",
"url": "https://github.com/AgeOfLearning/aofl"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "@aofl/cli-lib Prototype Pollution vulnerability"
}
GHSA-VH95-RMGR-6W4M
Vulnerability from github – Published: 2020-04-03 21:48 – Updated: 2024-02-13 20:00Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Recommendation
Upgrade to versions 0.2.1, 1.2.3 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "minimist"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "minimist"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7598"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2020-04-03T21:42:08Z",
"nvd_published_at": "2020-03-11T23:15:00Z",
"severity": "MODERATE"
},
"details": "Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. \nParsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. \nThis is exploitable if attackers have control over the arguments being passed to `minimist`.\n\n\n## Recommendation\n\nUpgrade to versions 0.2.1, 1.2.3 or later.",
"id": "GHSA-vh95-rmgr-6w4m",
"modified": "2024-02-13T20:00:13Z",
"published": "2020-04-03T21:48:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598"
},
{
"type": "WEB",
"url": "https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68"
},
{
"type": "WEB",
"url": "https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab"
},
{
"type": "WEB",
"url": "https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95"
},
{
"type": "WEB",
"url": "https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94"
},
{
"type": "PACKAGE",
"url": "https://github.com/substack/minimist"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1179"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in minimist"
}
GHSA-VHQP-R6HX-7VW5
Vulnerability from github – Published: 2026-07-28 21:31 – Updated: 2026-07-28 21:31IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.
{
"affected": [],
"aliases": [
"CVE-2026-14893"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-28T21:17:26Z",
"severity": "HIGH"
},
"details": "IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.",
"id": "GHSA-vhqp-r6hx-7vw5",
"modified": "2026-07-28T21:31:34Z",
"published": "2026-07-28T21:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14893"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7281349"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-VHXC-FHM5-QCP9
Vulnerability from github – Published: 2022-03-18 00:01 – Updated: 2022-03-18 22:56The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a proto payload. Note: This vulnerability derives from an incomplete fix to CVE-2019-10792
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "bodymen"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25296"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-18T22:56:29Z",
"nvd_published_at": "2022-03-17T12:15:00Z",
"severity": "MODERATE"
},
"details": "The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix to [CVE-2019-10792](https://security.snyk.io/vuln/SNYK-JS-BODYMEN-548897)",
"id": "GHSA-vhxc-fhm5-qcp9",
"modified": "2022-03-18T22:56:29Z",
"published": "2022-03-18T00:01:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25296"
},
{
"type": "PACKAGE",
"url": "https://github.com/diegohaz/bodymen"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-BODYMEN-2342623"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in bodymen"
}
GHSA-VJ54-72F3-P5JV
Vulnerability from github – Published: 2025-08-26 22:33 – Updated: 2025-08-27 14:271. devalue.parse allows __proto__ to be set
A string passed to devalue.parse could represent an object with a __proto__ property, which would assign a prototype to an object while allowing properties to be overwritten:
class Vector {
constructor(x, y) {
this.x = x;
this.y = y;
}
get magnitude() {
return (this.x ** 2 + this.y ** 2) ** 0.5;
}
}
const payload = `[{"x":1,"y":2,"magnitude":3,"__proto__":4},3,4,"nope",["Vector",5],[6,7],8,9]`;
const vector = devalue.parse(payload, {
Vector: ([x, y]) => new Vector(x, y)
});
console.log("Is vector", vector instanceof Vector); // true
console.log(vector.x) // 3
console.log(vector.y) // 4
console.log(vector.magnitude); // "nope" instead of 5
2. devalue.parse allows array prototype methods to be assigned to object
In a payload constructed with devalue.stringify, values are represented as array indices, where the array contains the 'hydrated' values:
devalue.stringify({ message: 'hello' }); // [{"message":1},"hello"]
devalue.parse does not check that an index is numeric, which means that it could assign an array prototype method to a property instead:
const object = devalue.parse('[{"toString":"push"}]');
object.toString(); // 0
This could be used by a creative attacker to bypass server-side validation.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "devalue"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-57820"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-26T22:33:14Z",
"nvd_published_at": "2025-08-26T23:15:35Z",
"severity": "HIGH"
},
"details": "## 1. `devalue.parse` allows `__proto__` to be set\n\nA string passed to `devalue.parse` could represent an object with a `__proto__` property, which would assign a prototype to an object while allowing properties to be overwritten:\n\n```js\nclass Vector {\n constructor(x, y) {\n this.x = x;\n this.y = y;\n }\n\n get magnitude() {\n return (this.x ** 2 + this.y ** 2) ** 0.5;\n }\n}\n\nconst payload = `[{\"x\":1,\"y\":2,\"magnitude\":3,\"__proto__\":4},3,4,\"nope\",[\"Vector\",5],[6,7],8,9]`;\n\nconst vector = devalue.parse(payload, {\n Vector: ([x, y]) =\u003e new Vector(x, y)\n});\n\nconsole.log(\"Is vector\", vector instanceof Vector); // true\nconsole.log(vector.x) // 3\nconsole.log(vector.y) // 4\nconsole.log(vector.magnitude); // \"nope\" instead of 5\n```\n\n## 2. `devalue.parse` allows array prototype methods to be assigned to object\n\nIn a payload constructed with `devalue.stringify`, values are represented as array indices, where the array contains the \u0027hydrated\u0027 values:\n\n```js\ndevalue.stringify({ message: \u0027hello\u0027 }); // [{\"message\":1},\"hello\"]\n```\n\n`devalue.parse` does not check that an index is numeric, which means that it could assign an array prototype method to a property instead:\n\n```js\nconst object = devalue.parse(\u0027[{\"toString\":\"push\"}]\u0027);\nobject.toString(); // 0\n```\n\nThis could be used by a creative attacker to bypass server-side validation.",
"id": "GHSA-vj54-72f3-p5jv",
"modified": "2025-08-27T14:27:08Z",
"published": "2025-08-26T22:33:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57820"
},
{
"type": "WEB",
"url": "https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1132"
},
{
"type": "PACKAGE",
"url": "https://github.com/sveltejs/devalue"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "devalue prototype pollution vulnerability"
}
GHSA-VJ5C-M527-MPFF
Vulnerability from github – Published: 2026-07-28 22:23 – Updated: 2026-07-28 22:23Impact
Prototype pollution.
A malicious user can create a token array [{ key: '{__proto__.foo}', value: 'malicious' }], when processed by convertTokenData() utility function, it will pollute the Object.prototype globally where {}.foo will equal { key: '{__proto__.foo}', value: 'malicious' }.
This has been confirmed with a test/reproduction.
You are impacted when:
- direct usage of convertTokenData(tokens, { output: 'object' });
- indirect usage, via using Expand API https://styledictionary.com/reference/config/#expand. If your expand config deems it necessary to run expand (this means, if NOT: 1) set to false, 2) all subprops set to false, or 3) undefined), then we sync the sd.tokens property with the sd.tokenMap property by converting tokenData map back to object.
- indirect usage via SD's transform lifecycle. Once your tokens are transformed, we also have to sync the sd.tokens property with the sd.tokenMap property.
Impact is high for this when style-dictionary is used as an integration in a NodeJS server application. Impact is moderate for when style-dictionary is used as an integration in a Web application. Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used.
Patches
A patch has been published: version 5.4.4.
Any version within range >=4.3.0 <5.4.4 contains this vulnerability, see commit hash 209085d for when the vulnerability was added.
See PR with repro + fix https://github.com/style-dictionary/style-dictionary/pull/1702
Workarounds
A workaround is to sanitize your token data first. Whether using DTCG format or old Style Dictionary format, you have to check the token data object recursively for any object keys that include __proto__.
You can do this with the StyleDictionary instance too, just ensure that expand has to be set to false to prevent the second method of this vulnerability from happening.
const sd = new StyleDictionary({ expand: false });
if (sd.allTokens.some(tok => tok.key.includes('__proto__')) {
throw new Error('Found malicious token key, attempting to do prototype pollution.')
}
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "style-dictionary"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "5.4.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54639"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-28T22:23:03Z",
"nvd_published_at": "2026-06-24T01:16:25Z",
"severity": "HIGH"
},
"details": "### Impact\nPrototype pollution.\nA malicious user can create a token array `[{ key: \u0027{__proto__.foo}\u0027, value: \u0027malicious\u0027 }]`, when processed by `convertTokenData()` utility function, it will pollute the Object.prototype globally where `{}.foo` will equal `{ key: \u0027{__proto__.foo}\u0027, value: \u0027malicious\u0027 }`.\n\nThis has been confirmed with a test/reproduction.\n\nYou are impacted when:\n- direct usage of `convertTokenData(tokens, { output: \u0027object\u0027 });`\n- indirect usage, via using Expand API https://styledictionary.com/reference/config/#expand. If your expand config deems it necessary to run expand (this means, if NOT: 1) set to false, 2) all subprops set to false, or 3) undefined), then we sync the `sd.tokens` property with the `sd.tokenMap` property by converting tokenData map back to object.\n- indirect usage via SD\u0027s transform lifecycle. Once your tokens are transformed, we also have to sync the `sd.tokens` property with the `sd.tokenMap` property.\n\nImpact is high for this when style-dictionary is used as an integration in a NodeJS server application.\nImpact is moderate for when style-dictionary is used as an integration in a Web application.\nImpact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used.\n\n### Patches\nA patch has been published: version `5.4.4`.\nAny version within range `\u003e=4.3.0 \u003c5.4.4` contains this vulnerability, see commit hash 209085d for when the vulnerability was added.\n\nSee PR with repro + fix https://github.com/style-dictionary/style-dictionary/pull/1702\n\n### Workarounds\nA workaround is to sanitize your token data first. Whether using DTCG format or old Style Dictionary format, you have to check the token data object recursively for any object keys that include `__proto__`.\n\nYou can do this with the StyleDictionary instance too, just ensure that expand has to be set to false to prevent the second method of this vulnerability from happening.\n\n```js\nconst sd = new StyleDictionary({ expand: false });\n\nif (sd.allTokens.some(tok =\u003e tok.key.includes(\u0027__proto__\u0027)) {\n throw new Error(\u0027Found malicious token key, attempting to do prototype pollution.\u0027)\n}\n```",
"id": "GHSA-vj5c-m527-mpff",
"modified": "2026-07-28T22:23:03Z",
"published": "2026-07-28T22:23:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/style-dictionary/style-dictionary/security/advisories/GHSA-vj5c-m527-mpff"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54639"
},
{
"type": "WEB",
"url": "https://github.com/style-dictionary/style-dictionary/pull/1702"
},
{
"type": "WEB",
"url": "https://github.com/style-dictionary/style-dictionary/commit/209085d9782cfc0783c4d983f3f1bb2c515954ec"
},
{
"type": "WEB",
"url": "https://github.com/style-dictionary/style-dictionary/commit/23b5e8dda143441f0d6b8e2b4222e2da98058bc5"
},
{
"type": "PACKAGE",
"url": "https://github.com/style-dictionary/style-dictionary"
},
{
"type": "WEB",
"url": "https://github.com/style-dictionary/style-dictionary/releases/tag/v5.4.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Style Dictionary - Prototype Pollution in convertTokenData utility function"
}
GHSA-VJ72-MWRJ-M2XQ
Vulnerability from github – Published: 2021-08-10 16:09 – Updated: 2021-08-31 21:21All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "deepmergefn"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23417"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-02T18:38:21Z",
"nvd_published_at": "2021-07-28T16:15:00Z",
"severity": "MODERATE"
},
"details": "All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.\n\n",
"id": "GHSA-vj72-mwrj-m2xq",
"modified": "2021-08-31T21:21:45Z",
"published": "2021-08-10T16:09:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23417"
},
{
"type": "PACKAGE",
"url": "https://github.com/jesusgm/deepmergefn"
},
{
"type": "WEB",
"url": "https://github.com/jesusgm/deepmergefn/blob/master/index.js#23L6"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-DEEPMERGEFN-1310984"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in deepmergefn"
}
GHSA-VP77-FQQP-79J8
Vulnerability from github – Published: 2021-04-13 15:20 – Updated: 2021-03-22 22:39This affects all versions of package decal. The vulnerability is in the set function.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "decal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-28449"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2021-03-22T22:39:06Z",
"nvd_published_at": "2021-02-04T15:15:00Z",
"severity": "HIGH"
},
"details": "This affects all versions of package decal. The vulnerability is in the set function.",
"id": "GHSA-vp77-fqqp-79j8",
"modified": "2021-03-22T22:39:06Z",
"published": "2021-04-13T15:20:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28449"
},
{
"type": "WEB",
"url": "https://github.com/gigafied/decal.js/blob/master/src/utils/set.js%23L45-L73"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-DECAL-1051007"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/decal"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in decal"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.