Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

CVEs (624)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-23417 1Deepmergefn Project 1Deepmergefn Jun 17, 2026 Jul 28, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
CVE-2021-23408 1Graphhopper 1Graphhopper Jun 17, 2026 Jul 21, 2021 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __p...Show more This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.Show less
CVE-2021-25953 1Putil Merge Project 1Putil Merge Jun 17, 2026 Jul 14, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25952 1Just Safe Set Project 1Just Safe Set Jun 17, 2026 Jul 7, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-23403 1Ts Nodash Project 1Ts Nodash Jun 17, 2026 Jul 2, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
CVE-2021-23402 1Record Like Deep Assign Project 1Record Like Deep Assign Jun 17, 2026 Jul 2, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
CVE-2021-32736 1Thinkjs 1Think Helper Jun 17, 2026 Jun 30, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updat...Show more think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3.Show less
CVE-2021-23396 1Lutils Project 1Lutils Jun 17, 2026 Jun 17, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.
CVE-2020-24939 1Stampit 1Supermixer Jun 17, 2026 Jun 16, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.
CVE-2021-23395 1Nedb Project 1Nedb Jun 17, 2026 Jun 15, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor.prototype payload.
CVE-2021-25949 1Set Getter Project 1Set Getter Jun 17, 2026 Jun 10, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25948 1Expand Hash Project 1Expand Hash Jun 17, 2026 Jun 10, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25947 1Nestie Project 1Nestie Jun 17, 2026 Jun 3, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-26707 2Merge Deep Project Netapp 2E Series Performance Analyzer Merge Deep Jun 17, 2026 Jun 2, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus faci...Show more The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.Show less
CVE-2021-25945 1Js Extend Project 1Js Extend Jun 17, 2026 May 26, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25946 1Nconf Toml Project 1Nconf Toml Jun 17, 2026 May 25, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25944 1Deep Defaults Project 1Deep Defaults Jun 17, 2026 May 25, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25943 1101 Project 1101 Jun 17, 2026 May 14, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25941 1Deep Override Project 1Deep Override Jun 17, 2026 May 14, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-23383 2Handlebarsjs Netapp 2E Series Performance Analyzer Handlebars Oct 8, 2026 May 4, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Previous 1...252627...32 Next