Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

CVEs (624)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-23631 1Blitzjs 2Blitz Superjson Jun 17, 2026 Feb 9, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior aut...Show more superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. This has been patched in superjson 1.8.1. Users are advised to update. There are no known workarounds for this issue.Show less
CVE-2022-23624 1Frourio 1Frourio Express Jun 17, 2026 Feb 7, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to...Show more Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-metadata`.Show less
CVE-2022-23623 1Frourio 1Frourio Jun 17, 2026 Feb 7, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability...Show more Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-metadata`.Show less
CVE-2021-23507 1Skratchdot 1Object Path Set Jun 17, 2026 Feb 4, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fi...Show more The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908Show less
CVE-2021-23497 1Set Project 1Set Jun 17, 2026 Feb 4, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. Note: This vulnerability derives from an incomplete fix in https://sec...Show more This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821Show less
CVE-2021-23470 1Putil Merge Project 1Putil Merge Jun 17, 2026 Feb 4, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor prope...Show more This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077Show less
CVE-2022-0432 1Joinmastodon 1Mastodon Jun 17, 2026 Feb 2, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
CVE-2021-23760 1Keyget Project 1Keyget Jun 17, 2026 Jan 28, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. Note: This vulne...Show more The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. Note: This vulnerability derives from an incomplete fix to [CVE-2020-28272](https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048)Show less
CVE-2021-23558 1Bmoor Project 1Bmoor Jun 17, 2026 Jan 28, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. Note: This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/v...Show more The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. Note: This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)Show less
CVE-2021-23518 2Cached Path Relative Project Debian 2Cached Path Relative Debian Linux Jun 17, 2026 Jan 21, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the p...Show more The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573Show less
CVE-2021-23460 1Camunda 1Min Dash Jun 17, 2026 Jan 21, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
CVE-2021-23594 1Agoric 1Realms Shim Jun 17, 2026 Jan 10, 2022 N/A· v4 10.0 CRITICAL· v3 7.5 HIGH· v2 All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
CVE-2021-23568 1Eggjs 1Extend2 Jun 17, 2026 Jan 10, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
CVE-2021-23543 1Agoric 1Realms Shim Jun 17, 2026 Jan 10, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
CVE-2021-43852 1Oroinc 1Oroplatform Jun 17, 2026 Jan 4, 2022 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects...Show more OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue.Show less
CVE-2021-23574 1Js Data 1Js Data Jun 17, 2026 Dec 24, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).
CVE-2021-23450 3Debian LinuxfoundationOracle 5Communications Policy Management Debian LinuxDojo+2 more Oct 8, 2026 Dec 17, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
CVE-2021-23700 1Merge Deep2 Project 1Merge Deep2 Jun 17, 2026 Dec 10, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.
CVE-2021-23663 1Sey Project 1Sey Jun 17, 2026 Dec 10, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.
CVE-2021-23561 1C2fo 1Comb Jun 17, 2026 Dec 10, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.

Previous 1...232425...32 Next