CWE-915
AllowedImproperly Controlled Modification of Dynamically-Determined Object Attributes
Abstraction: Base · Status: Incomplete
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
314 vulnerabilities reference this CWE, most recent first.
GHSA-HP36-V28F-W3R4
Vulnerability from github – Published: 2026-06-19 20:47 – Updated: 2026-06-19 20:47Summary
convert() builds the nested tree by using each flat record's id and parent field values directly as object keys, with no guard against __proto__ / constructor / prototype. A record whose parent is the string "__proto__" makes temp[parent] resolve to Object.prototype, and the following initPush(...) writes attacker-controlled data onto the global prototype. Any application that passes attacker-influenced records to convert() is affected, and the base prototype methods stay intact so the pollution is stealthy.
### Details
In index.js, convert() (FlatToNested.prototype.convert):
temp = {}(line 45) andpendingChildOf = {}(line 46) are plain objects, so they inherit fromObject.prototype.- For each record,
parent = flatEl[this.config.parent](line 51) is taken verbatim from input. - Line 57:
if (temp[parent] !== undefined)— whenparent === "__proto__",temp["__proto__"]resolves via the prototype chain toObject.prototype, which is!== undefined, so the branch is taken. - Line 59:
initPush(this.config.children, temp[parent], flatEl)→ effectivelyinitPush("children", Object.prototype, flatEl). initPush(lines 4-9):Object.prototype["children"] = []thenObject.prototype["children"].push(flatEl)— attacker-controlled data is written onto the globalObject.prototype.
There is no sanitization of id / parent anywhere; they flow straight into temp[id], temp[parent], and pendingChildOf[parent] as dynamic keys.
### PoC ```js const FlatToNested = require('flat-to-nested');
new FlatToNested().convert([ { id: 1, parent: 'proto', polluted: 'PWNED' } ]);
console.log(({}).children); // => [ { id: 1, polluted: 'PWNED' } ] A freshly-created, unrelated object {} now carries an attacker-controlled children property. ({}).toString === Object.prototype.toString remains true, so existing methods are untouched (stealthy). If the consumer configures a custom children key, that arbitrary prototype property is polluted instead. ```
### Impact
Prototype pollution (CWE-1321). Any service that builds a tree from attacker-influenced flat records (the package's core purpose — e.g. records derived from a DB/REST/user input) can have Object.prototype polluted. Consequences range from application-logic corruption and denial of service to serving as a gadget toward privilege escalation or RCE depending on downstream sinks. No special privileges or user interaction required; the malicious value is ordinary input data.
### Suggested fix
Use prototype-less lookup tables so inherited keys like proto cannot be reached: var temp = Object.create(null); var pendingChildOf = Object.create(null); (Optionally also reject id/parent values equal to proto, constructor, or prototype.) Verified: with Object.create(null) for both temp and pendingChildOf, the PoC no longer pollutes Object.prototype and normal nesting output is unchanged. A patch with a regression test is ready.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.1.1"
},
"package": {
"ecosystem": "npm",
"name": "flat-to-nested"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55091"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T20:47:52Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n `convert()` builds the nested tree by using each flat record\u0027s `id` and `parent` field values directly as object keys, with no guard against `__proto__` / `constructor` / `prototype`. A record whose `parent` is the string `\"__proto__\"` makes `temp[parent]` resolve to `Object.prototype`, and the following `initPush(...)` writes attacker-controlled data onto the global prototype. Any application that passes attacker-influenced records to `convert()` is affected, and the base prototype methods stay intact so the pollution is stealthy.\n\n ### Details\n In `index.js`, `convert()` (`FlatToNested.prototype.convert`):\n\n - `temp = {}` (line 45) and `pendingChildOf = {}` (line 46) are plain objects, so they inherit from `Object.prototype`.\n - For each record, `parent = flatEl[this.config.parent]` (line 51) is taken verbatim from input.\n - Line 57: `if (temp[parent] !== undefined)` \u2014 when `parent === \"__proto__\"`, `temp[\"__proto__\"]` resolves via the prototype chain to `Object.prototype`, which is `!== undefined`, so the\n branch is taken.\n - Line 59: `initPush(this.config.children, temp[parent], flatEl)` \u2192 effectively `initPush(\"children\", Object.prototype, flatEl)`.\n - `initPush` (lines 4-9): `Object.prototype[\"children\"] = []` then `Object.prototype[\"children\"].push(flatEl)` \u2014 **attacker-controlled data is written onto the global `Object.prototype`.**\n\n There is no sanitization of `id` / `parent` anywhere; they flow straight into `temp[id]`, `temp[parent]`, and `pendingChildOf[parent]` as dynamic keys.\n\n ### PoC\n ```js\n const FlatToNested = require(\u0027flat-to-nested\u0027);\n\n new FlatToNested().convert([\n { id: 1, parent: \u0027__proto__\u0027, polluted: \u0027PWNED\u0027 }\n ]);\n\n console.log(({}).children); // =\u003e [ { id: 1, polluted: \u0027PWNED\u0027 } ]\n A freshly-created, unrelated object {} now carries an attacker-controlled children property. ({}).toString === Object.prototype.toString remains true, so existing methods are untouched (stealthy). If the consumer configures a custom children key, that arbitrary prototype property is polluted instead.\n ```\n \n ### Impact\n\n Prototype pollution (CWE-1321). Any service that builds a tree from attacker-influenced flat records (the package\u0027s core purpose \u2014 e.g. records derived from a DB/REST/user input) can have Object.prototype polluted. Consequences range from application-logic corruption and denial of service to serving as a gadget toward privilege escalation or RCE depending on downstream sinks. No special privileges or user interaction required; the malicious value is ordinary input data.\n\n ### Suggested fix\n\n Use prototype-less lookup tables so inherited keys like __proto__ cannot be reached:\n var temp = Object.create(null);\n var pendingChildOf = Object.create(null);\n (Optionally also reject id/parent values equal to __proto__, constructor, or prototype.) Verified: with Object.create(null) for both temp and pendingChildOf, the PoC no longer pollutes Object.prototype and normal nesting output is unchanged. A patch with a regression test is ready.",
"id": "GHSA-hp36-v28f-w3r4",
"modified": "2026-06-19T20:47:52Z",
"published": "2026-06-19T20:47:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/joaonuno/flat-to-nested-js/security/advisories/GHSA-hp36-v28f-w3r4"
},
{
"type": "WEB",
"url": "https://github.com/joaonuno/flat-to-nested-js/commit/680a5ebe1194edda16fa93baaa56ff14fe0e3d7f"
},
{
"type": "PACKAGE",
"url": "https://github.com/joaonuno/flat-to-nested-js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key"
}
GHSA-J7CG-H9V9-6VQP
Vulnerability from github – Published: 2021-05-06 17:29 – Updated: 2023-09-07 22:07The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "irrelon-path"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.7.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@irrelon/path"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7708"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-05T21:25:03Z",
"nvd_published_at": "2020-08-18T15:15:00Z",
"severity": "CRITICAL"
},
"details": "The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.",
"id": "GHSA-j7cg-h9v9-6vqp",
"modified": "2023-09-07T22:07:24Z",
"published": "2021-05-06T17:29:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7708"
},
{
"type": "WEB",
"url": "https://github.com/Irrelon/irrelon-path/commit/8a126b160c1a854ae511659c111413ad9910ebe3"
},
{
"type": "PACKAGE",
"url": "https://github.com/Irrelon/irrelon-path"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-IRRELONPATH-598672"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-IRRELONPATH-598673"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in irrelon-path and @irrelon/path"
}
GHSA-JGG9-RW32-44PJ
Vulnerability from github – Published: 2026-05-14 20:15 – Updated: 2026-06-09 10:19Impact
Persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.
Patches
Not yet
Workarounds
- Do not import unsafe data
References
- Report / credit: https://github.com/Curly-Haired-Baboon
- Electerm releases: https://github.com/electerm/electerm/releases
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "electerm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.8.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45058"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-494",
"CWE-915",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T20:15:42Z",
"nvd_published_at": "2026-05-28T18:16:34Z",
"severity": "CRITICAL"
},
"details": "### Impact\n_Persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject `exec*` fields or global config to cause remote code to run when a bookmark is opened or when sync is applied._\n\n### Patches\n\nNot yet\n\n### Workarounds\n- Do not import unsafe data\n\n### References\n- Report / credit: https://github.com/Curly-Haired-Baboon\n- Electerm releases: https://github.com/electerm/electerm/releases",
"id": "GHSA-jgg9-rw32-44pj",
"modified": "2026-06-09T10:19:27Z",
"published": "2026-05-14T20:15:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/electerm/electerm/security/advisories/GHSA-jgg9-rw32-44pj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45058"
},
{
"type": "PACKAGE",
"url": "https://github.com/electerm/electerm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark"
}
GHSA-JGPQ-G82G-6C39
Vulnerability from github – Published: 2020-04-07 15:52 – Updated: 2021-07-28 23:16confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "confinit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7638"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2020-04-07T15:51:51Z",
"nvd_published_at": "2020-04-06T13:15:00Z",
"severity": "MODERATE"
},
"details": "confinit through 0.3.0 is vulnerable to Prototype Pollution.The \u0027setDeepProperty\u0027 function could be tricked into adding or modifying properties of \u0027Object.prototype\u0027 using a \u0027__proto__\u0027 payload.",
"id": "GHSA-jgpq-g82g-6c39",
"modified": "2021-07-28T23:16:44Z",
"published": "2020-04-07T15:52:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7638"
},
{
"type": "WEB",
"url": "https://github.com/davideicardi/confinit/commit/a34e06ca5c1c8b047ef112ef188b2fe30d2a1eab"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-CONFINIT-564433"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "confinit vulnerable to prototype pollution"
}
GHSA-JQV5-7XPX-QJ74
Vulnerability from github – Published: 2023-03-13 20:00 – Updated: 2023-03-16 21:34Impact
Due to the underlying implementation of .ToString(), it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.
Users of sqlite3 v5.0.0 - v5.1.4 are affected by this.
Patches
Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.
Workarounds
- Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.
References
- Commit: https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781
For more information
If you have any questions or comments about this advisory:
- Email us at security@ghost.org
Credits: Dave McDaniel of Cisco Talos
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sqlite3"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.1.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-43441"
],
"database_specific": {
"cwe_ids": [
"CWE-913",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-13T20:00:52Z",
"nvd_published_at": "2023-03-16T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nDue to the underlying implementation of `.ToString()`, it\u0027s possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.\n\nUsers of `sqlite3` v5.0.0 - v5.1.4 are affected by this.\n\n### Patches\n\nFixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.\n\n### Workarounds\n\n* Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.\n\n### References\n\n* Commit: https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Email us at [security@ghost.org](mailto:security@ghost.org)\n\nCredits: Dave McDaniel of Cisco Talos",
"id": "GHSA-jqv5-7xpx-qj74",
"modified": "2023-03-16T21:34:27Z",
"published": "2023-03-13T20:00:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TryGhost/node-sqlite3/security/advisories/GHSA-jqv5-7xpx-qj74"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43441"
},
{
"type": "WEB",
"url": "https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781"
},
{
"type": "PACKAGE",
"url": "https://github.com/TryGhost/node-sqlite3"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1645"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "sqlite vulnerable to code execution due to Object coercion"
}
GHSA-JV35-XQG7-F92R
Vulnerability from github – Published: 2021-06-21 17:16 – Updated: 2023-09-13 20:02Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "set-getter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-25949"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-14T19:22:58Z",
"nvd_published_at": "2021-06-10T12:15:00Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in \u2018set-getter\u2019 version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.",
"id": "GHSA-jv35-xqg7-f92r",
"modified": "2023-09-13T20:02:47Z",
"published": "2021-06-21T17:16:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25949"
},
{
"type": "WEB",
"url": "https://github.com/doowb/set-getter/commit/66eb3f0d4686a4a8c7c3d6f7ecd8e570b580edc4"
},
{
"type": "PACKAGE",
"url": "https://github.com/doowb/set-getter"
},
{
"type": "WEB",
"url": "https://github.com/doowb/set-getter/blob/5bc2750fe1c3db9651d936131be187744111378d/index.js#L56"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20210615022308/https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25949"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "set-getter Prototype Pollution Vulnerability"
}
GHSA-JVF5-Q4H5-2JMJ
Vulnerability from github – Published: 2021-05-06 17:28 – Updated: 2021-05-05 21:41madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "madlib-object-utils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7701"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-05T21:41:45Z",
"nvd_published_at": "2020-08-14T15:15:00Z",
"severity": "CRITICAL"
},
"details": "madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.",
"id": "GHSA-jvf5-q4h5-2jmj",
"modified": "2021-05-05T21:41:45Z",
"published": "2021-05-06T17:28:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7701"
},
{
"type": "WEB",
"url": "https://github.com/Qwerios/madlib-object-utils/commit/2a8d5be4fddfe46b69fbe25b9ebdff49a54481a8"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in madlib-object-utils"
}
GHSA-JVFF-X2QM-6286
Vulnerability from github – Published: 2026-04-10 22:10 – Updated: 2026-05-08 19:55Impact
This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.
Patches
The issue was introduced in mathjs v13.1.0, and patched in mathjs v15.2.0.
Workarounds
There is no workaround without upgrading to v15.2.0.
References
You can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/24d5ee7e25e85d49619b09122f055db4139bc057 (part of PR https://github.com/josdejong/mathjs/pull/3656).
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mathjs"
},
"ranges": [
{
"events": [
{
"introduced": "13.1.0"
},
{
"fixed": "15.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41139"
],
"database_specific": {
"cwe_ids": [
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-10T22:10:49Z",
"nvd_published_at": "2026-05-07T06:16:04Z",
"severity": "HIGH"
},
"details": "### Impact\nThis security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.\n\n### Patches\nThe issue was introduced in mathjs `v13.1.0`, and patched in mathjs `v15.2.0`.\n\n### Workarounds\nThere is no workaround without upgrading to `v15.2.0`.\n\n### References\nYou can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/24d5ee7e25e85d49619b09122f055db4139bc057 (part of PR https://github.com/josdejong/mathjs/pull/3656).",
"id": "GHSA-jvff-x2qm-6286",
"modified": "2026-05-08T19:55:44Z",
"published": "2026-04-10T22:10:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g"
},
{
"type": "WEB",
"url": "https://github.com/josdejong/mathjs/security/advisories/GHSA-jvff-x2qm-6286"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41139"
},
{
"type": "WEB",
"url": "https://github.com/josdejong/mathjs/pull/3656"
},
{
"type": "WEB",
"url": "https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4"
},
{
"type": "WEB",
"url": "https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611"
},
{
"type": "PACKAGE",
"url": "https://github.com/josdejong/mathjs"
},
{
"type": "WEB",
"url": "https://github.com/josdejong/mathjs/releases/tag/v15.2.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes"
}
GHSA-M4G7-VV6G-5MPC
Vulnerability from github – Published: 2026-08-07 18:31 – Updated: 2026-08-07 18:31Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.
{
"affected": [],
"aliases": [
"CVE-2026-17598"
],
"database_specific": {
"cwe_ids": [
"CWE-915"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-07T17:17:00Z",
"severity": "MODERATE"
},
"details": "Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.",
"id": "GHSA-m4g7-vv6g-5mpc",
"modified": "2026-08-07T18:31:44Z",
"published": "2026-08-07T18:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17598"
},
{
"type": "WEB",
"url": "https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html"
},
{
"type": "WEB",
"url": "https://support.sonatype.com/hc/en-us/articles/53880086360211"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M6VV-VCJ8-W8M7
Vulnerability from github – Published: 2025-11-18 18:32 – Updated: 2025-11-18 21:39Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "10.4.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"events": [
{
"introduced": "10.5.0"
},
{
"fixed": "10.5.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.1.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"events": [
{
"introduced": "11.2.0"
},
{
"fixed": "11.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-13081"
],
"database_specific": {
"cwe_ids": [
"CWE-502",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-18T21:39:36Z",
"nvd_published_at": "2025-11-18T17:15:58Z",
"severity": "MODERATE"
},
"details": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.",
"id": "GHSA-m6vv-vcj8-w8m7",
"modified": "2025-11-18T21:39:36Z",
"published": "2025-11-18T18:32:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13081"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2025-006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Drupal core allows Object Injection"
}
Mitigation
- If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
- For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.
Mitigation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Mitigation
Strategy: Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
Mitigation
Strategy: Refactoring
Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.
No CAPEC attack patterns related to this CWE.