Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

CVEs (624)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-29823 1Feathersjs 1Feathers Sequelize Jun 17, 2026 Oct 26, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.
CVE-2022-37598 1Uglifyjs Project 1Uglifyjs Jun 17, 2026 Oct 20, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
CVE-2022-37602 1Grunt Karma Project 1Grunt Karma Jun 17, 2026 Oct 14, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.
CVE-2022-37601 2Debian Webpack.js 2Debian Linux Loader Utils Jun 17, 2026 Oct 12, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
CVE-2022-37614 1Mockery Project 1Mockery Jun 17, 2026 Oct 12, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js.
CVE-2022-37611 1Gh Pages Project 1Gh Pages Jun 17, 2026 Oct 12, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.
CVE-2022-37617 1Browserify Shim Project 1Browserify Shim Jun 17, 2026 Oct 11, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js.
CVE-2022-37609 1Js Beautify Project 1Js Beautify Jun 17, 2026 Oct 11, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js.
CVE-2022-37616 2Debian Xmldom Project 2Debian Linux Xmldom Jun 17, 2026 Oct 11, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of...Show more A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."Show less
CVE-2022-21169 1Express Xss Sanitizer Project 1Express Xss Sanitizer Jun 17, 2026 Sep 26, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
CVE-2020-36604 1Hapijs 1Hoek Jun 17, 2026 Sep 23, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
CVE-2022-37265 1Stealjs 1Steal Jun 17, 2026 Sep 20, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.
CVE-2022-37258 1Stealjs 1Steal Jun 17, 2026 Sep 16, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.
CVE-2022-37264 1Stealjs 1Steal Jun 17, 2026 Sep 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.
CVE-2022-37266 1Stealjs 1Steal Jun 17, 2026 Sep 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js.
CVE-2022-37257 1Stealjs 1Steal Jul 9, 2026 Sep 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js.
CVE-2022-2625 3Fedoraproject PostgresqlRedhat 3Enterprise Linux FedoraPostgresql Jun 17, 2026 Aug 18, 2022 N/A· v4 8.0 HIGH· v3 N/A· v2 A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension...Show more A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.Show less
CVE-2022-25907 1Typescript Deep Merge Project 1Typescript Deep Merge Jun 17, 2026 Aug 9, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.
CVE-2022-2564 1Mongoosejs 1Mongoose Jun 17, 2026 Jul 28, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
CVE-2021-23397 1Merge Project 1Merge Jun 17, 2026 Jul 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.

Previous 1...202122...32 Next