Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

CVEs (624)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-39018 - - Jun 17, 2026 Jul 1, 2024 N/A· v4 6.3 MEDIUM· v3 N/A· v2 harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injec...Show more harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-39016 - - Jun 17, 2026 Jul 1, 2024 N/A· v4 8.1 HIGH· v3 N/A· v2 che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitra...Show more che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-39014 - - Jun 17, 2026 Jul 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary...Show more ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-39013 - - Jun 17, 2026 Jul 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary proper...Show more 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-39008 - - Jun 17, 2026 Jul 1, 2024 N/A· v4 10.0 CRITICAL· v3 N/A· v2 robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injectin...Show more robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-39003 1Amoyjs 1Common Jun 17, 2026 Jul 1, 2024 N/A· v4 7.3 HIGH· v3 N/A· v2 amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitra...Show more amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-39001 1Ag Grid 2Ag Grid Ag Charts Jun 17, 2026 Jul 1, 2024 N/A· v4 6.3 MEDIUM· v3 N/A· v2 ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via...Show more ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-39000 1Swiperjs 1Swiper Jun 17, 2026 Jul 1, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbit...Show more adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-38999 - - Jun 17, 2026 Jul 1, 2024 N/A· v4 10.0 CRITICAL· v3 N/A· v2 jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injec...Show more jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-38997 1Swiperjs 1Swiper Jun 17, 2026 Jul 1, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via inject...Show more adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-38996 1Ag Grid 1Ag Grid Jun 17, 2026 Jul 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of S...Show more ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-38994 1Amoyjs 1Common Jun 17, 2026 Jul 1, 2024 N/A· v4 7.3 HIGH· v3 N/A· v2 amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary...Show more amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-38992 - - Jun 17, 2026 Jul 1, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arb...Show more airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-38991 - - Jun 17, 2026 Jul 1, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary...Show more akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-38987 - - Jun 17, 2026 Jul 1, 2024 N/A· v4 6.3 MEDIUM· v3 N/A· v2 aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrar...Show more aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.Show less
CVE-2024-36578 - - Jun 17, 2026 Jun 17, 2024 N/A· v4 5.9 MEDIUM· v3 N/A· v2 akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.
CVE-2024-36577 - - Jun 17, 2026 Jun 17, 2024 N/A· v4 8.3 HIGH· v3 N/A· v2 apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.
CVE-2024-36574 - - Jun 17, 2026 Jun 17, 2024 N/A· v4 6.3 MEDIUM· v3 N/A· v2 A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)
CVE-2024-36573 - - Jun 17, 2026 Jun 17, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.
CVE-2024-36582 - - Jun 17, 2026 Jun 17, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)

Previous 1...151617...32 Next