Common Weakness Enumeration

CWE-1321

Allowed

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Abstraction: Variant · Status: Incomplete

API response cwe.mitre.org

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

978 vulnerabilities reference this CWE, most recent first.

CVE-2026-118678 (GCVE-0-2026-118678)

Vulnerability from cvelistv5 – Published: 2026-10-28 18:59 – Updated: 2026-10-28 18:59
VLAI
Title
n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
Summary
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as __proto__ to workflow connections, which the periodic history compaction task processes, causing logins and writes to fail with server errors.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CWE
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7010 records in the last 180 days details
References
Impacted products
Vendor Product Version
n8n-io n8n Affected: 0 , < 2.41.4 (semver)
Unaffected: 2.41.4 (semver)
Create a notification for this product.
n8n-io n8n Affected: 2.42.0 , < 2.42.1 (semver)
Unaffected: 2.42.1 (semver)
Create a notification for this product.
Date Public
2026-10-14 00:00
Credits
Masofgon
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/n8n",
          "product": "n8n",
          "vendor": "n8n-io",
          "versions": [
            {
              "lessThan": "2.41.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.41.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/n8n",
          "product": "n8n",
          "vendor": "n8n-io",
          "versions": [
            {
              "lessThan": "2.42.1",
              "status": "affected",
              "version": "2.42.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.42.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.41.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.42.1",
                  "versionStartIncluding": "2.42.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Masofgon"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as __proto__ to workflow connections, which the periodic history compaction task processes, causing logins and writes to fail with server errors."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T18:59:50.449Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fvv4-gmv9-xqf5)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-fvv4-gmv9-xqf5"
        },
        {
          "name": "VulnCheck Advisory: n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-prototype-pollution-dos-via-workflow-history-compaction"
        }
      ],
      "title": "n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-118678",
    "datePublished": "2026-10-28T18:59:50.449Z",
    "dateReserved": "2026-10-28T17:28:46.441Z",
    "dateUpdated": "2026-10-28T18:59:50.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118649 (GCVE-0-2026-118649)

Vulnerability from cvelistv5 – Published: 2026-10-28 18:59 – Updated: 2026-10-28 18:59
VLAI
Title
n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
Summary
n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CWE
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7010 records in the last 180 days details
References
Impacted products
Vendor Product Version
n8n-io n8n Affected: 2.44.0 , < 2.44.1 (semver)
Unaffected: 2.44.1 (semver)
Create a notification for this product.
n8n-io n8n Affected: 0 , < 2.43.5 (semver)
Unaffected: 2.43.5 (semver)
Create a notification for this product.
Date Public
2026-10-14 00:00
Credits
momenashrafff
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/n8n",
          "product": "n8n",
          "vendor": "n8n-io",
          "versions": [
            {
              "lessThan": "2.44.1",
              "status": "affected",
              "version": "2.44.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.44.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/n8n",
          "product": "n8n",
          "vendor": "n8n-io",
          "versions": [
            {
              "lessThan": "2.43.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.43.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.44.1",
                  "versionStartIncluding": "2.44.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.43.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "momenashrafff"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow\u0027s owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T18:59:47.664Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wvjj-qg37-pv73)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-wvjj-qg37-pv73"
        },
        {
          "name": "VulnCheck Advisory: n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/n8n-before-2.43.5-and-2.44.1-authorization-bypass-via-crafted-workflow-id-in-data-tables"
        }
      ],
      "title": "n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-118649",
    "datePublished": "2026-10-28T18:59:47.664Z",
    "dateReserved": "2026-10-28T17:24:54.847Z",
    "dateUpdated": "2026-10-28T18:59:47.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118250 (GCVE-0-2026-118250)

Vulnerability from cvelistv5 – Published: 2026-10-28 17:59 – Updated: 2026-10-28 17:59
VLAI
Title
Highcharts: dotted series.keys paths write to Object.prototype
Summary
Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.
Severity
7.2 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L
CWE
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7940 records in the last 180 days details
References
Impacted products
Vendor Product Version
highcharts highcharts Affected: >= 6.1.0, < 11.4.9
Affected: >= 12.0.0, < 12.6.1
Affected: >= 13.0.0, < 13.1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "highcharts",
          "vendor": "highcharts",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.1.0, \u003c 11.4.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 12.0.0, \u003c 12.6.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 13.0.0, \u003c 13.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:59:48.828Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c"
        },
        {
          "name": "https://github.com/highcharts/highcharts/pull/25313",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/pull/25313"
        },
        {
          "name": "https://github.com/highcharts/highcharts/commit/fd4ee8140732618bbe71295aba55398fb1f8fa9e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/commit/fd4ee8140732618bbe71295aba55398fb1f8fa9e"
        },
        {
          "name": "https://github.com/highcharts/highcharts/releases/tag/v13.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/releases/tag/v13.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rmqc-xvr3-v46c",
        "discovery": "UNKNOWN"
      },
      "title": "Highcharts: dotted series.keys paths write to Object.prototype"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118250",
    "datePublished": "2026-10-28T17:59:48.828Z",
    "dateReserved": "2026-10-27T20:13:55.313Z",
    "dateUpdated": "2026-10-28T17:59:48.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118249 (GCVE-0-2026-118249)

Vulnerability from cvelistv5 – Published: 2026-10-28 17:57 – Updated: 2026-10-28 17:57
VLAI
Title
Highcharts: series column construction writes to Object.prototype
Summary
Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.
Severity
7.2 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L
CWE
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7940 records in the last 180 days details
References
Impacted products
Vendor Product Version
highcharts highcharts Affected: >= 13.0.0, < 13.1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "highcharts",
          "vendor": "highcharts",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 13.0.0, \u003c 13.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:57:18.323Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-gfvx-2c2g-38wq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-gfvx-2c2g-38wq"
        },
        {
          "name": "https://github.com/highcharts/highcharts/pull/25321",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/pull/25321"
        },
        {
          "name": "https://github.com/highcharts/highcharts/commit/d3357705c8f348904441327e32f50ab528c3a205",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/commit/d3357705c8f348904441327e32f50ab528c3a205"
        },
        {
          "name": "https://github.com/highcharts/highcharts/releases/tag/v13.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/releases/tag/v13.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gfvx-2c2g-38wq",
        "discovery": "UNKNOWN"
      },
      "title": "Highcharts: series column construction writes to Object.prototype"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118249",
    "datePublished": "2026-10-28T17:57:18.323Z",
    "dateReserved": "2026-10-27T20:13:55.313Z",
    "dateUpdated": "2026-10-28T17:57:18.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118248 (GCVE-0-2026-118248)

Vulnerability from cvelistv5 – Published: 2026-10-28 17:55 – Updated: 2026-10-28 17:55
VLAI
Title
Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
Summary
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:L/SI:L/SA:L
CWE
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7940 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "highcharts",
          "vendor": "highcharts",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 13.1.0"
            }
          ]
        },
        {
          "product": "dashboards",
          "vendor": "@highcharts",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 4.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user\u0027s edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:55:47.520Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-wg5j-9wp8-2ggm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-wg5j-9wp8-2ggm"
        },
        {
          "name": "https://github.com/highcharts/highcharts/commit/05efb9849130461fe61992ea8f58d22edaad978b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/commit/05efb9849130461fe61992ea8f58d22edaad978b"
        },
        {
          "name": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2"
        }
      ],
      "source": {
        "advisory": "GHSA-wg5j-9wp8-2ggm",
        "discovery": "UNKNOWN"
      },
      "title": "Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118248",
    "datePublished": "2026-10-28T17:55:47.520Z",
    "dateReserved": "2026-10-27T20:13:55.313Z",
    "dateUpdated": "2026-10-28T17:55:47.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118247 (GCVE-0-2026-118247)

Vulnerability from cvelistv5 – Published: 2026-10-28 17:50 – Updated: 2026-10-28 17:50
VLAI
Title
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
Summary
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ or constructor. DataTable.setCell, including Dashboards connector write-back and Grid Pro editing paths, can therefore write integer-indexed values onto Object.prototype or the Object constructor. In Dashboards releases with column aliases, a literal __proto__ ID is redirected by the alias map, while an alias targeting __proto__ reaches the unsafe write; later releases without aliases accept the unsafe ID directly. Those inherited values affect array and object reads and for-in enumeration throughout the page, which can alter application control flow or disrupt rendering. Exploitation requires control of the table or component column ID and a cell, point, or API write. This issue is fixed in Dashboards 4.2.2 and Grid Pro 3.2.0.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:L/SI:L/SA:L
CWE
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7940 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "highcharts",
          "vendor": "highcharts",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 13.1.0"
            }
          ]
        },
        {
          "product": "dashboards",
          "vendor": "@highcharts",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 4.2.3"
            }
          ]
        },
        {
          "product": "grid-pro",
          "vendor": "@highcharts",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 3.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ or constructor. DataTable.setCell, including Dashboards connector write-back and Grid Pro editing paths, can therefore write integer-indexed values onto Object.prototype or the Object constructor. In Dashboards releases with column aliases, a literal __proto__ ID is redirected by the alias map, while an alias targeting __proto__ reaches the unsafe write; later releases without aliases accept the unsafe ID directly. Those inherited values affect array and object reads and for-in enumeration throughout the page, which can alter application control flow or disrupt rendering. Exploitation requires control of the table or component column ID and a cell, point, or API write. This issue is fixed in Dashboards 4.2.2 and Grid Pro 3.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:50:59.526Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-c75x-9x9h-28rm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-c75x-9x9h-28rm"
        },
        {
          "name": "https://github.com/highcharts/highcharts/commit/02dd9349aeb6f4cc9c98806120d917ed316b4c74",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/commit/02dd9349aeb6f4cc9c98806120d917ed316b4c74"
        },
        {
          "name": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2"
        },
        {
          "name": "https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-c75x-9x9h-28rm",
        "discovery": "UNKNOWN"
      },
      "title": "Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118247",
    "datePublished": "2026-10-28T17:50:59.526Z",
    "dateReserved": "2026-10-27T20:13:55.313Z",
    "dateUpdated": "2026-10-28T17:50:59.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118243 (GCVE-0-2026-118243)

Vulnerability from cvelistv5 – Published: 2026-10-28 17:33 – Updated: 2026-10-28 17:33
VLAI
Title
Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
Summary
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates an enumerable property there whose suffix can be influenced through the sync group option. The property is visible on every object, and lasting sync states can throw and stop features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and an enabled component sync, but no user interaction beyond loading the board. This issue is fixed in 4.2.2.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L
CWE
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7940 records in the last 180 days details
References
Impacted products
Vendor Product Version
highcharts highcharts Affected: >= 1.0.0, < 4.2.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "highcharts",
          "vendor": "highcharts",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 4.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates an enumerable property there whose suffix can be influenced through the sync group option. The property is visible on every object, and lasting sync states can throw and stop features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and an enabled component sync, but no user interaction beyond loading the board. This issue is fixed in 4.2.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:33:31.422Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-jqgh-w3cc-7jqw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-jqgh-w3cc-7jqw"
        },
        {
          "name": "https://github.com/highcharts/highcharts/commit/ade5a41a700212f09133223ca990a3737d1d9ec6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/commit/ade5a41a700212f09133223ca990a3737d1d9ec6"
        },
        {
          "name": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2"
        }
      ],
      "source": {
        "advisory": "GHSA-jqgh-w3cc-7jqw",
        "discovery": "UNKNOWN"
      },
      "title": "Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118243",
    "datePublished": "2026-10-28T17:33:31.422Z",
    "dateReserved": "2026-10-27T20:13:55.312Z",
    "dateUpdated": "2026-10-28T17:33:31.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116674 (GCVE-0-2026-116674)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:40 – Updated: 2026-10-27 16:40
VLAI
Title
systeminformation: Prototype pollution in `networkStats()` via the interface name
Summary
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
CWE
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7940 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "systeminformation",
          "vendor": "sebhildebrandt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.33.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own cache entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and their values come from interface statistics, but inherited-name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior. This issue is fixed in version 5.33.13."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:40:46.246Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-7648-jmwf-vw7j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-7648-jmwf-vw7j"
        },
        {
          "name": "https://github.com/sebhildebrandt/systeminformation/commit/6ff25a1ebc0b1fdc7a8aa3507e46f22007da2969",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sebhildebrandt/systeminformation/commit/6ff25a1ebc0b1fdc7a8aa3507e46f22007da2969"
        },
        {
          "name": "https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.13"
        }
      ],
      "source": {
        "advisory": "GHSA-7648-jmwf-vw7j",
        "discovery": "UNKNOWN"
      },
      "title": "systeminformation: Prototype pollution in `networkStats()` via the interface name"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116674",
    "datePublished": "2026-10-27T16:40:46.246Z",
    "dateReserved": "2026-10-26T20:00:59.829Z",
    "dateUpdated": "2026-10-27T16:40:46.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114142 (GCVE-0-2026-114142)

Vulnerability from cvelistv5 – Published: 2026-10-21 20:28 – Updated: 2026-10-28 18:19
VLAI
Title
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
Summary
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.
Severity
8.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 18:18 UTC
CWE
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7940 records in the last 180 days details
References
Impacted products
Vendor Product Version
BinaryMuse toml-node Affected: < 5.0.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114142",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T18:18:57.178068Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T18:19:14.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "toml-node",
          "vendor": "BinaryMuse",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key\u0027s guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T20:28:36.615Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-h895-cgqg-jf52",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-h895-cgqg-jf52"
        },
        {
          "name": "https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606"
        },
        {
          "name": "https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-h895-cgqg-jf52",
        "discovery": "UNKNOWN"
      },
      "title": "toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114142",
    "datePublished": "2026-10-21T20:28:36.615Z",
    "dateReserved": "2026-10-20T21:53:58.473Z",
    "dateUpdated": "2026-10-28T18:19:14.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113666 (GCVE-0-2026-113666)

Vulnerability from cvelistv5 – Published: 2026-10-20 17:25 – Updated: 2026-10-20 17:43
VLAI
Title
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
Summary
ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 17:41 UTC
CWE
  • CWE-400 - Uncontrolled Resource Consumption
  • CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7940 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113666",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T17:41:23.661474Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T17:43:12.999Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-j5rq-xfvr-p969"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "apostrophe",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.33.0"
            }
          ]
        },
        {
          "product": "db-connect",
          "vendor": "@apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T17:25:44.574Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-j5rq-xfvr-p969",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-j5rq-xfvr-p969"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/db-connect@1.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/db-connect@1.1.0"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
        }
      ],
      "source": {
        "advisory": "GHSA-j5rq-xfvr-p969",
        "discovery": "UNKNOWN"
      },
      "title": "ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-113666",
    "datePublished": "2026-10-20T17:25:44.574Z",
    "dateReserved": "2026-10-20T14:27:46.641Z",
    "dateUpdated": "2026-10-20T17:43:12.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Implementation

By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

Mitigation
Architecture and Design

By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Mitigation
Implementation

Strategy: Input Validation

When handling untrusted objects, validating using a schema can be used.

Mitigation
Implementation

By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.

Mitigation
Implementation

Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list