CWE-915
AllowedImproperly Controlled Modification of Dynamically-Determined Object Attributes
Abstraction: Base · Status: Incomplete
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
363 vulnerabilities reference this CWE, most recent first.
GHSA-RP28-MVQ3-WF8J
Vulnerability from github – Published: 2025-03-14 15:32 – Updated: 2025-03-19 15:32A Privilege Escalation through a Mass Assignment exists in Camaleon CMS
When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "camaleon_cms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-2304"
],
"database_specific": {
"cwe_ids": [
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-17T14:34:48Z",
"nvd_published_at": "2025-03-14T13:15:41Z",
"severity": "CRITICAL"
},
"details": "A Privilege Escalation through a Mass Assignment exists in Camaleon CMS\n\nWhen a user wishes to change his password, the \u0027updated_ajax\u0027 method of the UsersController is called. The vulnerability stems from the use of the dangerous permit!\u00a0method, which allows all parameters to pass through without any filtering.",
"id": "GHSA-rp28-mvq3-wf8j",
"modified": "2025-03-19T15:32:04Z",
"published": "2025-03-14T15:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2304"
},
{
"type": "WEB",
"url": "https://github.com/owen2345/camaleon-cms/pull/1109"
},
{
"type": "WEB",
"url": "https://github.com/owen2345/camaleon-cms/commit/179fd6b1ecf258d3e214aebfa87ac4a322ea4db4"
},
{
"type": "PACKAGE",
"url": "https://github.com/owen2345/camaleon-cms"
},
{
"type": "WEB",
"url": "https://github.com/owen2345/camaleon-cms/releases/tag/2.9.1"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2025-2304.yml"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2025-09"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment"
}
GHSA-RP7V-4384-HFRP
Vulnerability from github – Published: 2026-04-24 16:37 – Updated: 2026-04-24 16:37Summary
In the auto-remediation pipeline, object_to_execution.go was deserializing the AI-generated YAML directly into a Deployment object, but there was lack of validation from the original Deployment object.
Details
This issue was fixed after coordination with Alex Jones.
PoC
To minimize the impact, the PoC of this vulnerability wasn't released, but was shared with the maintainers.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/k8sgpt-ai/k8sgpt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.32"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-502",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-24T16:37:12Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nIn the auto-remediation pipeline, `object_to_execution.go` was deserializing the AI-generated YAML directly into a Deployment object, but there was lack of validation from the original Deployment object.\n\n### Details\nThis issue was fixed after coordination with Alex Jones.\n\n### PoC\nTo minimize the impact, the PoC of this vulnerability wasn\u0027t released, but was shared with the maintainers.",
"id": "GHSA-rp7v-4384-hfrp",
"modified": "2026-04-24T16:37:12Z",
"published": "2026-04-24T16:37:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/k8sgpt-ai/k8sgpt/security/advisories/GHSA-rp7v-4384-hfrp"
},
{
"type": "PACKAGE",
"url": "https://github.com/k8sgpt-ai/k8sgpt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "k8sGPT has Prompt Injection through its k8sGPT-Operator"
}
GHSA-RRQM-P222-8PH2
Vulnerability from github – Published: 2021-02-08 17:44 – Updated: 2022-05-26 19:58Impact
In Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method lib/utils/object/set.ts. This method is used throughout the codebase for various operations throughout Dynamoose.
We have not seen any evidence of this vulnerability being exploited.
We do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.
Patches
v2.7.0 includes a patch for this vulnerability.
Workarounds
We are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.
References
- Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e
For more information
If you have any questions or comments about this advisory:
Credit
- GitHub CodeQL Code Scanning
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "dynamoose"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21304"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-02-08T17:43:18Z",
"nvd_published_at": "2021-02-08T18:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nIn Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method [`lib/utils/object/set.ts`](https://github.com/dynamoose/dynamoose/blob/master/lib/utils/object/set.ts). This method is used throughout the codebase for various operations throughout Dynamoose.\n\nWe have not seen any evidence of this vulnerability being exploited.\n\nWe do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.\n\n### Patches\n\nv2.7.0 includes a patch for this vulnerability.\n\n### Workarounds\n\nWe are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.\n\n### References\n\n- Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Contact me](https://charlie.fish/contact)\n* [Read our Security Policy](https://github.com/dynamoose/dynamoose/blob/master/SECURITY.md)\n\n### Credit\n\n- GitHub CodeQL Code Scanning",
"id": "GHSA-rrqm-p222-8ph2",
"modified": "2022-05-26T19:58:25Z",
"published": "2021-02-08T17:44:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dynamoose/dynamoose/security/advisories/GHSA-rrqm-p222-8ph2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21304"
},
{
"type": "WEB",
"url": "https://github.com/dynamoose/dynamoose/commit/324c62b4709204955931a187362f8999805b1d8e"
},
{
"type": "PACKAGE",
"url": "https://github.com/dynamoose/dynamoose"
},
{
"type": "WEB",
"url": "https://github.com/dynamoose/dynamoose/releases/tag/v2.7.0"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/dynamoose"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in Dynamoose"
}
GHSA-RV28-58VF-V4PV
Vulnerability from github – Published: 2022-05-13 01:22 – Updated: 2022-05-13 01:22An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.
{
"affected": [],
"aliases": [
"CVE-2019-9058"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-26T17:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.",
"id": "GHSA-rv28-58vf-v4pv",
"modified": "2022-05-13T01:22:59Z",
"published": "2022-05-13T01:22:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9058"
},
{
"type": "WEB",
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"type": "WEB",
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXRV-835Q-V5MH
Vulnerability from github – Published: 2026-02-02 22:21 – Updated: 2026-10-05 15:34Summary
A Prototype Pollution vulnerability exists in the the npm package locutus (>2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39.
Details
The vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parse_str.js where includes() function is used to check whether user provided input contain forbidden strings.
PoC
Steps to reproduce
- Install latest version of locutus using npm install or cloning from git
- Run the following code snippet:
String.prototype.includes = () => false;
console.log({}.polluted);
const locutus = require('locutus');
locutus.php.strings.parse_str('constructor[prototype][polluted]=yes');
console.log({}.polluted); // prints yes -> indicating that the patch was bypassed and Prototype Pollution occurred
Expected behavior
Prototype Pollution should be prevented and {} should not gain new properties. This should be printed on the console:
undefined
undefined OR throw an Error
Actual behavior
Object.prototype is polluted This is printed on the console:
undefined
yes
Impact
This is a Prototype Pollution vulnerability, which can have severe security implications depending on how locutus is used by downstream applications. Any application that processes attacker-controlled input using this locutus.php.strings.parse_str may be affected. It could potentially lead to the following problems:
1. Authentication bypass
2. Denial of service
3. Remote code execution (if polluted property is passed to sinks like eval or child_process)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "locutus"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.12"
},
{
"fixed": "2.0.39"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25521"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-02T22:21:54Z",
"nvd_published_at": "2026-02-04T22:15:59Z",
"severity": "CRITICAL"
},
"details": "### Summary\nA Prototype Pollution vulnerability exists in the the npm package locutus (\u003e2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39.\n\n### Details\nThe vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parse_str.js where includes() function is used to check whether user provided input contain forbidden strings.\n\n### PoC\n\n#### Steps to reproduce\n1. Install latest version of locutus using npm install or cloning from git\n2. Run the following code snippet:\n\n```javascript\nString.prototype.includes = () =\u003e false; \nconsole.log({}.polluted);\nconst locutus = require(\u0027locutus\u0027);\nlocutus.php.strings.parse_str(\u0027constructor[prototype][polluted]=yes\u0027);\nconsole.log({}.polluted); // prints yes -\u003e indicating that the patch was bypassed and Prototype Pollution occurred\n```\n\n#### Expected behavior\nPrototype Pollution should be prevented and {} should not gain new properties.\nThis should be printed on the console:\n```\nundefined\nundefined OR throw an Error\n```\n\n#### Actual behavior\nObject.prototype is polluted\nThis is printed on the console:\n```\nundefined \nyes\n```\n\n### Impact\nThis is a Prototype Pollution vulnerability, which can have severe security implications depending on how locutus is used by downstream applications. Any application that processes attacker-controlled input using this `locutus.php.strings.parse_str` may be affected. It could potentially lead to the following problems:\n1. Authentication bypass\n2. Denial of service\n3. Remote code execution (if polluted property is passed to sinks like eval or child_process)",
"id": "GHSA-rxrv-835q-v5mh",
"modified": "2026-10-05T15:34:16Z",
"published": "2026-02-02T22:21:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25521"
},
{
"type": "WEB",
"url": "https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-25521"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436950"
},
{
"type": "PACKAGE",
"url": "https://github.com/locutusjs/locutus"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25521.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "locutus is vulnerable to Prototype Pollution"
}
GHSA-V26W-GCXH-V4R7
Vulnerability from github – Published: 2021-12-10 18:50 – Updated: 2022-06-29 20:42Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "just-safe-set"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "2.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-25952"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-07-08T14:23:30Z",
"nvd_published_at": "2021-07-07T12:15:00Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in \u2018just-safe-set\u2019 versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.",
"id": "GHSA-v26w-gcxh-v4r7",
"modified": "2022-06-29T20:42:16Z",
"published": "2021-12-10T18:50:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25952"
},
{
"type": "WEB",
"url": "https://github.com/angus-c/just/pull/267"
},
{
"type": "WEB",
"url": "https://github.com/angus-c/just/commit/dd57a476f4bb9d78c6f60741898dc04c71d2eb53"
},
{
"type": "PACKAGE",
"url": "https://github.com/angus-c/just"
},
{
"type": "WEB",
"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25952"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype polluation in just-safe-set"
}
GHSA-V39H-QM32-8GWQ
Vulnerability from github – Published: 2021-12-09 19:57 – Updated: 2021-07-29 15:53express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the Object.prototype. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by express-mock-middleware. As such, this is considered to be a low risk.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "express-mock-middleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7616"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-25T17:28:15Z",
"nvd_published_at": "2020-04-07T14:15:00Z",
"severity": "MODERATE"
},
"details": "express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by `express-mock-middleware`. As such, this is considered to be a low risk.",
"id": "GHSA-v39h-qm32-8gwq",
"modified": "2021-07-29T15:53:05Z",
"published": "2021-12-09T19:57:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7616"
},
{
"type": "WEB",
"url": "https://github.com/LingyuCoder/express-mock-middleware/blob/master/lib/index.js#L39"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-EXPRESSMOCKMIDDLEWARE-564120"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware"
}
GHSA-V3F3-CMJ4-CVJ9
Vulnerability from github – Published: 2026-09-23 18:33 – Updated: 2026-09-23 18:33Impact
The control panel action formie/integrations/form-settings (IntegrationsController::actionFormSettings) was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via setAttributes($settings, false), allowing an attacker to overwrite outbound host properties (e.g. apiUrl) while the server sent stored API keys or OAuth tokens to the attacker-controlled host. The remote response was returned in the JSON body (non-blind SSRF).
This is an incomplete remediation of GHSA-cvpc-hccg-wmw4. The form-settings action was excluded from the permission gate added in 3.1.28.
Any site where a low-privileged user can authenticate (including front-end members on sites with public registration) could exfiltrate CRM/email-marketing/webhook integration credentials and probe internal network endpoints.
Patches
Fixed in 3.1.31 (Craft 5) and 2.2.23 (Craft 4).
The action now requires a CP request, a valid formId, and form integration permissions (formie-showFormIntegrations / per-form variant on Craft 5; formie-manageFormIntegrations / per-form variant on Craft 4). Request settings are filtered to an allowlist; URL, host, and credential properties cannot be overridden from user input.
Workarounds
Restrict front-end user registration and limit CP access until upgraded. No configuration-only workaround fully mitigates the issue.
- Reported by Jorge González (jorge@jmilla.es)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "verbb/formie"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.31"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "verbb/formie"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.23"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-76086"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-915",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-23T18:33:57Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nThe control panel action `formie/integrations/form-settings` (`IntegrationsController::actionFormSettings`) was reachable by any authenticated user without the appropriate form integration permissions. The action applied request-supplied settings to a fully configured integration via `setAttributes($settings, false)`, allowing an attacker to overwrite outbound host properties (e.g. `apiUrl`) while the server sent stored API keys or OAuth tokens to the attacker-controlled host. The remote response was returned in the JSON body (non-blind SSRF).\n\nThis is an incomplete remediation of [GHSA-cvpc-hccg-wmw4](https://github.com/advisories?query=GHSA-cvpc-hccg-wmw4). The `form-settings` action was excluded from the permission gate added in 3.1.28.\n\nAny site where a low-privileged user can authenticate (including front-end members on sites with public registration) could exfiltrate CRM/email-marketing/webhook integration credentials and probe internal network endpoints.\n\n### Patches\n\nFixed in **3.1.31** (Craft 5) and **2.2.23** (Craft 4).\n\nThe action now requires a CP request, a valid `formId`, and form integration permissions (`formie-showFormIntegrations` / per-form variant on Craft 5; `formie-manageFormIntegrations` / per-form variant on Craft 4). Request settings are filtered to an allowlist; URL, host, and credential properties cannot be overridden from user input.\n\n### Workarounds\n\nRestrict front-end user registration and limit CP access until upgraded. No configuration-only workaround fully mitigates the issue.\n\n- Reported by Jorge Gonz\u00e1lez (jorge@jmilla.es)",
"id": "GHSA-v3f3-cmj4-cvj9",
"modified": "2026-09-23T18:33:57Z",
"published": "2026-09-23T18:33:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9"
},
{
"type": "WEB",
"url": "https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d"
},
{
"type": "WEB",
"url": "https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-cvpc-hccg-wmw4"
},
{
"type": "PACKAGE",
"url": "https://github.com/verbb/formie"
},
{
"type": "WEB",
"url": "https://github.com/verbb/formie/releases/tag/2.2.23"
},
{
"type": "WEB",
"url": "https://github.com/verbb/formie/releases/tag/3.1.31"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials"
}
GHSA-V6FR-2XP3-XPR7
Vulnerability from github – Published: 2026-06-19 15:33 – Updated: 2026-06-19 15:33In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible
{
"affected": [],
"aliases": [
"CVE-2026-56142"
],
"database_specific": {
"cwe_ids": [
"CWE-915"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-19T13:16:37Z",
"severity": "CRITICAL"
},
"details": "In JetBrains Hub before 2026.1.13757,\n2025.3.148033,\n2025.2.148048,\n2025.1.148120,\n2024.3.148430,\n2024.2.148429 privilege escalation by attaching authentication details to accounts was possible",
"id": "GHSA-v6fr-2xp3-xpr7",
"modified": "2026-06-19T15:33:15Z",
"published": "2026-06-19T15:33:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56142"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V88G-CGMW-V5XW
Vulnerability from github – Published: 2022-02-10 23:30 – Updated: 2024-06-21 21:33An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "ajv"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.12.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-15366"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-10T21:23:41Z",
"nvd_published_at": "2020-07-15T20:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)",
"id": "GHSA-v88g-cgmw-v5xw",
"modified": "2024-06-21T21:33:48Z",
"published": "2022-02-10T23:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15366"
},
{
"type": "WEB",
"url": "https://github.com/ajv-validator/ajv/commit/65b2f7d76b190ac63a0d4e9154c712d7aa37049f"
},
{
"type": "PACKAGE",
"url": "https://github.com/ajv-validator/ajv"
},
{
"type": "WEB",
"url": "https://github.com/ajv-validator/ajv/releases/tag/v6.12.3"
},
{
"type": "WEB",
"url": "https://github.com/ajv-validator/ajv/tags"
},
{
"type": "WEB",
"url": "https://hackerone.com/bugs?subject=user\u0026report_id=894259"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240621-0007"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in Ajv"
}
Mitigation
- If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
- For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.
Mitigation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Mitigation
Strategy: Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
Mitigation
Strategy: Refactoring
Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.
No CAPEC attack patterns related to this CWE.