CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
826 vulnerabilities reference this CWE, most recent first.
GHSA-G452-6RFC-VRVX
Vulnerability from github – Published: 2021-09-01 18:31 – Updated: 2021-08-30 21:26This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "open-graph"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23419"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-30T21:26:31Z",
"nvd_published_at": "2021-08-08T08:15:00Z",
"severity": "MODERATE"
},
"details": "This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.",
"id": "GHSA-g452-6rfc-vrvx",
"modified": "2021-08-30T21:26:46Z",
"published": "2021-09-01T18:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23419"
},
{
"type": "WEB",
"url": "https://github.com/samholmes/node-open-graph/commit/a0cef507a90adaac7dbbe9c404f09a50bdefb348"
},
{
"type": "PACKAGE",
"url": "https://github.com/samholmes/node-open-graph"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-OPENGRAPH-1536747"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in open-graph"
}
GHSA-G4GQ-J4P2-J8FR
Vulnerability from github – Published: 2021-08-05 17:00 – Updated: 2024-09-03 21:14Impact
Background: The optional add-on package Products.PythonScripts adds Script (Python) to the list of content items a user can add to the Zope object database. Inside these scripts users can write Python code that is executed when rendered through the web. The code environment in these script objects is limited, it relies on the RestrictedPython package to provide a "safe" subset of Python instructions as well as the AccessControl package that defines security policies for execution in the context of a Zope application.
Recently the AccessControl package was updated to fix a remote code execution security issue. A link to the security advisory is provided in the References section below. The bug tightens the AccessControl security policies for Zope by blocking access to unsafe classes inside the Python string module.
You are only affected if the following are true:
- You use Python 3 for your Zope deployment (Zope 4 on Python 2 is not affected)
- You run Zope 4 below version 4.6.3 or Zope 5 below version 5.3
- You have installed the optional
Products.PythonScriptsadd-on package
By default, you need to have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web - which would be a very unusual configuration to begin with - are at risk.
Patches
The problem has been fixed in AccessControl versions 4.3 and 5.2. Zope releases 4.6.3 and 5.3 now require these new AccessControl releases.
Workarounds
A site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.
References
For more information
If you have any questions or comments about this advisory: * Open an issue in the Zope issue tracker * Email us at security@plone.org
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Zope"
},
"ranges": [
{
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.6.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Zope"
},
"ranges": [
{
"events": [
{
"introduced": "5.0"
},
{
"fixed": "5.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-32811"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-02T22:57:25Z",
"nvd_published_at": "2021-08-02T22:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nBackground: The optional add-on package `Products.PythonScripts` adds `Script (Python)` to the list of content items a user can add to the Zope object database. Inside these scripts users can write Python code that is executed when rendered through the web. The code environment in these script objects is limited, it relies on the `RestrictedPython` package to provide a \"safe\" subset of Python instructions as well as the `AccessControl` package that defines security policies for execution in the context of a Zope application.\n\nRecently the `AccessControl` package was updated to fix a remote code execution security issue. A link to the security advisory is provided in the References section below. The bug tightens the `AccessControl` security policies for Zope by blocking access to unsafe classes inside the Python `string` module.\n\nYou are only affected if the following are true:\n\n- You use Python 3 for your Zope deployment (Zope 4 on Python 2 is not affected)\n- You run Zope 4 below version 4.6.3 or Zope 5 below version 5.3\n- You have installed the optional `Products.PythonScripts` add-on package\n\nBy default, you need to have the admin-level Zope \"Manager\" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web - which would be a very unusual configuration to begin with - are at risk.\n\n### Patches\nThe problem has been fixed in `AccessControl` versions 4.3 and 5.2. Zope releases 4.6.3 and 5.3 now require these new `AccessControl` releases.\n\n### Workarounds\nA site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.\n\n### References\n* [AccessControl security advisory GHSA-qcx9-j53g-ccgf](https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [Zope issue tracker](https://github.com/zopefoundation/Zope/issues)\n* Email us at [security@plone.org](mailto:security@plone.org)\n\n",
"id": "GHSA-g4gq-j4p2-j8fr",
"modified": "2024-09-03T21:14:03Z",
"published": "2021-08-05T17:00:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf"
},
{
"type": "WEB",
"url": "https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8fr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32811"
},
{
"type": "WEB",
"url": "https://github.com/zopefoundation/Zope/commit/869f947e586517566509e0ccdd4d99b60704cc02"
},
{
"type": "WEB",
"url": "https://github.com/zopefoundation/Zope/commit/f72a18dda8e9bf2aedb46168761668464a4be988"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2021-368.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/zopefoundation/Zope"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Remote Code Execution via Script (Python) objects under Python 3"
}
GHSA-G64Q-3VG8-8F93
Vulnerability from github – Published: 2020-09-03 15:47 – Updated: 2025-09-30 16:16All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.
Recommendation
This package is deprecated and is now maintained as @hapi/pez. Please update your dependencies to use @hapi/pez.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "pez"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T19:00:49Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "All versions of `pez` are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts\u2019 content can be set as the entire payload object\u2019s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.\n\n\n## Recommendation\n\nThis package is deprecated and is now maintained as `@hapi/pez`. Please update your dependencies to use `@hapi/pez`.",
"id": "GHSA-g64q-3vg8-8f93",
"modified": "2025-09-30T16:16:58Z",
"published": "2020-09-03T15:47:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hapijs/pez/compare/v4.1.1...v4.1.2"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1479"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Prototype Pollution in pez"
}
GHSA-G6WW-V8XP-VMWG
Vulnerability from github – Published: 2022-02-10 20:21 – Updated: 2022-04-18 21:58A prototype pollution vulnerability affects all versions of package pathval under 1.1.1.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "pathval"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7751"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-20T17:32:20Z",
"nvd_published_at": "2020-10-26T12:17:00Z",
"severity": "HIGH"
},
"details": "A prototype pollution vulnerability affects all versions of package pathval under 1.1.1.",
"id": "GHSA-g6ww-v8xp-vmwg",
"modified": "2022-04-18T21:58:49Z",
"published": "2022-02-10T20:21:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7751"
},
{
"type": "WEB",
"url": "https://github.com/chaijs/pathval/pull/58/commits/21a9046cfa0c2697cb41990f3b4316db410e6c8a"
},
{
"type": "WEB",
"url": "https://github.com/chaijs/pathval/pull/58/files"
},
{
"type": "PACKAGE",
"url": "https://github.com/chaijs/pathval"
},
{
"type": "WEB",
"url": "https://github.com/chaijs/pathval/releases/tag/v1.1.1"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-PATHVAL-596926"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution in pathval"
}
GHSA-G78F-549W-C354
Vulnerability from github – Published: 2021-04-13 15:23 – Updated: 2021-04-07 23:21This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "multi-ini"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-28448"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-07T23:21:37Z",
"nvd_published_at": "2020-12-22T13:15:00Z",
"severity": "CRITICAL"
},
"details": "This affects the package multi-ini before 2.1.1. It is possible to pollute an object\u0027s prototype by specifying the proto object as part of an array.",
"id": "GHSA-g78f-549w-c354",
"modified": "2021-04-07T23:21:37Z",
"published": "2021-04-13T15:23:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28448"
},
{
"type": "WEB",
"url": "https://github.com/evangelion1204/multi-ini/pull/37"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-MULTIINI-1048969"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in multi-ini"
}
GHSA-G7H8-P22M-2RVX
Vulnerability from github – Published: 2020-09-04 15:08 – Updated: 2020-08-31 18:55All versions of flat-wrap are vulnerable to prototype pollution. The function unflatten does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "flat-wrap"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:55:16Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "All versions of `flat-wrap` are vulnerable to prototype pollution. The function `unflatten` does not restrict the modification of an Object\u0027s prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
"id": "GHSA-g7h8-p22m-2rvx",
"modified": "2020-08-31T18:55:16Z",
"published": "2020-09-04T15:08:46Z",
"references": [
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1327"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Prototype Pollution in flat-wrap"
}
GHSA-G7WQ-WGGW-VMHG
Vulnerability from github – Published: 2025-09-24 21:30 – Updated: 2025-09-25 17:32A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided keys in the assign function allows attackers to manipulate the Object.prototype chain. By leveraging this flaw, adversaries may inject arbitrary properties into the global object's prototype, potentially leading to application crashes, unexpected code execution behaviors, or bypasses of security-critical validation logic dependent on prototype integrity. The vulnerability stems from improper handling of deep property assignment operations within the library's public API functions. This issue remains unaddressed in the latest available version.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "ts-fns"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "13.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-57351"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-25T17:32:34Z",
"nvd_published_at": "2025-09-24T19:15:40Z",
"severity": "MODERATE"
},
"details": "A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided keys in the assign function allows attackers to manipulate the Object.prototype chain. By leveraging this flaw, adversaries may inject arbitrary properties into the global object\u0027s prototype, potentially leading to application crashes, unexpected code execution behaviors, or bypasses of security-critical validation logic dependent on prototype integrity. The vulnerability stems from improper handling of deep property assignment operations within the library\u0027s public API functions. This issue remains unaddressed in the latest available version.",
"id": "GHSA-g7wq-wggw-vmhg",
"modified": "2025-09-25T17:32:34Z",
"published": "2025-09-24T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57351"
},
{
"type": "WEB",
"url": "https://github.com/tangshuang/ts-fns/issues/36"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57351"
},
{
"type": "PACKAGE",
"url": "https://github.com/tangshuang/ts-fns"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ts-fns has prototype pollution vulnerability"
}
GHSA-G954-5HWP-PP24
Vulnerability from github – Published: 2022-05-28 00:00 – Updated: 2022-08-17 15:36The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable.
This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "protobufjs"
},
"ranges": [
{
"events": [
{
"introduced": "6.11.0"
},
{
"fixed": "6.11.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "protobufjs"
},
"ranges": [
{
"events": [
{
"introduced": "6.10.0"
},
{
"fixed": "6.10.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25878"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-02T20:36:05Z",
"nvd_published_at": "2022-05-27T20:15:00Z",
"severity": "HIGH"
},
"details": "The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable.\n\nThis vulnerability can occur in multiple ways:\n1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions\n2. by parsing/loading .proto files\n\n\n",
"id": "GHSA-g954-5hwp-pp24",
"modified": "2022-08-17T15:36:47Z",
"published": "2022-05-28T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25878"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/pull/1731"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/pull/1735"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73f5511b2e8f"
},
{
"type": "PACKAGE",
"url": "https://github.com/protobufjs/protobuf.js"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf/src/util.js%23L176-L197"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in protobufjs"
}
GHSA-G974-HXVM-X689
Vulnerability from github – Published: 2024-09-10 06:30 – Updated: 2024-11-18 16:27All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "node-gettext"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-21528"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-10T15:52:56Z",
"nvd_published_at": "2024-09-10T05:15:10Z",
"severity": "HIGH"
},
"details": "All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.",
"id": "GHSA-g974-hxvm-x689",
"modified": "2024-11-18T16:27:11Z",
"published": "2024-09-10T06:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21528"
},
{
"type": "PACKAGE",
"url": "https://github.com/alexanderwallin/node-gettext"
},
{
"type": "WEB",
"url": "https://github.com/alexanderwallin/node-gettext/blob/65d9670f691c2eeca40dce129c95bcf8b613d344/lib/gettext.js#L113"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-NODEGETTEXT-6100943"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "node-gettext vulnerable to Prototype Pollution"
}
GHSA-G9CG-H3JM-CWRC
Vulnerability from github – Published: 2020-09-03 15:47 – Updated: 2025-09-26 23:12Versions of @hapi/pez prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.
Recommendation
Upgrade to versions 5.0.1 or later. There is a fix available for version 4.1.2, but it only available for direct download from the repository.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@hapi/pez"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T19:00:51Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Versions of `@hapi/pez` prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts\u2019 content can be set as the entire payload object\u2019s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.\n\n## Recommendation\n\nUpgrade to versions 5.0.1 or later. There is a fix available for version 4.1.2, but it only available for direct download from the repository.",
"id": "GHSA-g9cg-h3jm-cwrc",
"modified": "2025-09-26T23:12:03Z",
"published": "2020-09-03T15:47:23Z",
"references": [
{
"type": "PACKAGE",
"url": "https://github.com/hapijs/pez"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1480"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Prototype Pollution in @hapi/subtext"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.