CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
928 vulnerabilities reference this CWE, most recent first.
GHSA-WHPX-G542-7C7V
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-11 17:35harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@cat5th/key-serializer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-39018"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-11T17:35:46Z",
"nvd_published_at": "2024-07-01T13:15:05Z",
"severity": "MODERATE"
},
"details": "harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function \"query\". This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
"id": "GHSA-whpx-g542-7c7v",
"modified": "2024-07-11T17:35:46Z",
"published": "2024-07-01T15:32:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39018"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/be75c60307b2292884cc03cebd361f3f"
},
{
"type": "PACKAGE",
"url": "https://github.com/harvey-woo/key-serializer"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "@cat5th/key-serializer Prototype Pollution vulnerability"
}
GHSA-WJC4-73Q6-GV3M
Vulnerability from github – Published: 2024-01-03 06:30 – Updated: 2025-12-26 15:16In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "plotly/plotly.js"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.25.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "plotly.js"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.25.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-46308"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-03T19:38:54Z",
"nvd_published_at": "2024-01-03T05:15:11Z",
"severity": "CRITICAL"
},
"details": "In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.",
"id": "GHSA-wjc4-73q6-gv3m",
"modified": "2025-12-26T15:16:48Z",
"published": "2024-01-03T06:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46308"
},
{
"type": "WEB",
"url": "https://github.com/plotly/plotly.R/issues/2463"
},
{
"type": "WEB",
"url": "https://github.com/plotly/plotly.js/commit/02498404c8ad7a3395191e65694fb142a37b0fe9"
},
{
"type": "WEB",
"url": "https://github.com/plotly/plotly.js/commit/5efd2a1f07a418b230a5626fc6c1c7929c47949d"
},
{
"type": "PACKAGE",
"url": "https://github.com/plotly/plotly.js"
},
{
"type": "WEB",
"url": "https://github.com/plotly/plotly.js/releases/tag/v2.25.2"
},
{
"type": "WEB",
"url": "https://plotly.com/javascript"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "plotly.js prototype pollution vulnerability"
}
GHSA-WJPC-CGVW-XX23
Vulnerability from github – Published: 2021-12-16 14:29 – Updated: 2023-09-08 21:04All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sey"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23663"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-12-14T14:35:47Z",
"nvd_published_at": "2021-12-10T20:15:00Z",
"severity": "MODERATE"
},
"details": "All versions of package `sey` are vulnerable to Prototype Pollution via the `deepmerge()` function.",
"id": "GHSA-wjpc-cgvw-xx23",
"modified": "2023-09-08T21:04:57Z",
"published": "2021-12-16T14:29:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23663"
},
{
"type": "PACKAGE",
"url": "https://github.com/eserozvataf/sey"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-SEY-1727592"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in sey"
}
GHSA-WM32-M2H7-232M
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-03 18:47adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
{
"affected": [],
"aliases": [
"CVE-2024-39000"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-01T13:15:05Z",
"severity": "MODERATE"
},
"details": "adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
"id": "GHSA-wm32-m2h7-232m",
"modified": "2024-07-03T18:47:34Z",
"published": "2024-07-01T15:32:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39000"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/840f5d160aab4151bd0451cfb822e6b5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WP4H-PVGW-5727
Vulnerability from github – Published: 2021-12-02 14:50 – Updated: 2021-12-02 14:45Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.struts:struts2-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.5.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-0230"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-12-02T14:45:03Z",
"nvd_published_at": "2020-09-14T17:15:00Z",
"severity": "CRITICAL"
},
"details": "Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.",
"id": "GHSA-wp4h-pvgw-5727",
"modified": "2021-12-02T14:45:03Z",
"published": "2021-12-02T14:50:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0230"
},
{
"type": "WEB",
"url": "https://cwiki.apache.org/confluence/display/ww/s2-059"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/struts"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2982840"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts"
}
GHSA-WPGH-HMV4-R3V5
Vulnerability from github – Published: 2021-06-21 17:18 – Updated: 2021-05-20 21:52Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "safe-obj"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"last_affected": "1.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-25928"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-20T21:52:15Z",
"nvd_published_at": "2021-04-26T11:15:00Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in \u0027safe-obj\u0027 versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.",
"id": "GHSA-wpgh-hmv4-r3v5",
"modified": "2021-05-20T21:52:15Z",
"published": "2021-06-21T17:18:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25928"
},
{
"type": "WEB",
"url": "https://github.com/mantacode/safe-obj/blob/6ab63529182b6cf11704ac84f10800290afd3f9f/lib/index.js#L122"
},
{
"type": "WEB",
"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25928"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution in safe-obj"
}
GHSA-WQPM-VFFM-39W4
Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-02-06 18:31A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
{
"affected": [],
"aliases": [
"CVE-2024-57078"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T22:15:32Z",
"severity": "HIGH"
},
"details": "A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.",
"id": "GHSA-wqpm-vffm-39w4",
"modified": "2025-02-06T18:31:05Z",
"published": "2025-02-06T06:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57078"
},
{
"type": "WEB",
"url": "https://gist.github.com/tariqhawis/b58d7274d67e7b9fed4bd51368388a23"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WR44-6HXH-3JWQ
Vulnerability from github – Published: 2026-09-13 12:31 – Updated: 2026-10-05 23:29joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "joi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "17.13.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "joi"
},
"ranges": [
{
"events": [
{
"introduced": "18.0.0"
},
{
"fixed": "18.2.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-90771"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T23:29:52Z",
"nvd_published_at": "2026-09-13T11:17:01Z",
"severity": "MODERATE"
},
"details": "joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object\u0027s prototype, breaking downstream code relying on Object.prototype methods.",
"id": "GHSA-wr44-6hxh-3jwq",
"modified": "2026-10-05T23:29:52Z",
"published": "2026-09-13T12:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90771"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/issues/3150"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/pull/3151"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/pull/3153"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb"
},
{
"type": "PACKAGE",
"url": "https://github.com/hapijs/joi"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/releases/tag/v17.13.8"
},
{
"type": "WEB",
"url": "https://github.com/hapijs/joi/releases/tag/v18.2.9"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "joi messages compilation allows prototype replacement through __proto__ error codes"
}
GHSA-WRWR-H859-XH2R
Vulnerability from github – Published: 2026-05-14 16:17 – Updated: 2026-07-20 13:40Impact
An authenticated user with permission to create or modify workflows could bypass the patch for GHSA-hqr4-h3xv-9m3r in the XML node. When combined with other nodes, this could lead to RCE on the n8n host.
Patches
The issue has been fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Disable the XML node by adding n8n-nodes-base.xml to the NODES_EXCLUDE environment variable.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
n8n has adopted CVSS 4.0 as primary score for all security advisories. CVSS 3.1 vector strings are provided for backwards compatibility.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.123.43"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.21.0"
},
{
"fixed": "2.22.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-rc.0"
},
{
"fixed": "2.20.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44791"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T16:17:49Z",
"nvd_published_at": "2026-06-23T17:16:59Z",
"severity": "CRITICAL"
},
"details": "## Impact\nAn authenticated user with permission to create or modify workflows could bypass the patch for GHSA-hqr4-h3xv-9m3r in the XML node. When combined with other nodes, this could lead to RCE on the n8n host.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Disable the XML node by adding `n8n-nodes-base.xml` to the `NODES_EXCLUDE` environment variable.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.\n\n---\nn8n has adopted CVSS 4.0 as primary score for all security advisories. CVSS 3.1 vector strings are provided for backwards compatibility.\n\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"id": "GHSA-wrwr-h859-xh2r",
"modified": "2026-07-20T13:40:56Z",
"published": "2026-05-14T16:17:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-wrwr-h859-xh2r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44791"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-hqr4-h3xv-9m3r"
},
{
"type": "PACKAGE",
"url": "https://github.com/n8n-io/n8n"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "n8n Has an XML Node Prototype Pollution Patch Bypass"
}
GHSA-WVR2-Q86M-6WHP
Vulnerability from github – Published: 2023-01-07 21:30 – Updated: 2023-01-12 22:47A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The name of the patch is c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "baobab"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-4307"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-09T21:54:36Z",
"nvd_published_at": "2023-01-07T20:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The name of the patch is c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.",
"id": "GHSA-wvr2-q86m-6whp",
"modified": "2023-01-12T22:47:31Z",
"published": "2023-01-07T21:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4307"
},
{
"type": "WEB",
"url": "https://github.com/Yomguithereal/baobab/pull/511"
},
{
"type": "WEB",
"url": "https://github.com/Yomguithereal/baobab/commit/c56639532a923d9a1600fb863ec7551b188b5d19"
},
{
"type": "PACKAGE",
"url": "https://github.com/Yomguithereal/baobab"
},
{
"type": "WEB",
"url": "https://github.com/Yomguithereal/baobab/releases/tag/2.6.1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217627"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217627"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Baobab vulnerable to Prototype Pollution"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.