CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
783 vulnerabilities reference this CWE, most recent first.
GHSA-RJ5F-7C8X-GJG4
Vulnerability from github – Published: 2021-05-06 18:26 – Updated: 2021-05-05 18:14All versions of package promisehelpers up to and including version 0.0.5 are vulnerable to Prototype Pollution via the insert function.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "promisehelpers"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7723"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-05T18:14:15Z",
"nvd_published_at": "2020-09-01T10:15:00Z",
"severity": "CRITICAL"
},
"details": "All versions of package promisehelpers up to and including version 0.0.5 are vulnerable to Prototype Pollution via the insert function.",
"id": "GHSA-rj5f-7c8x-gjg4",
"modified": "2021-05-05T18:14:15Z",
"published": "2021-05-06T18:26:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7723"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-PROMISEHELPERS-598686"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in promisehelpers"
}
GHSA-RJF2-J2R6-Q8GR
Vulnerability from github – Published: 2021-10-19 15:28 – Updated: 2021-10-19 14:18This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "vm2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23449"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-10-19T14:18:05Z",
"nvd_published_at": "2021-10-18T17:15:00Z",
"severity": "CRITICAL"
},
"details": "This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.",
"id": "GHSA-rjf2-j2r6-q8gr",
"modified": "2021-10-19T14:18:05Z",
"published": "2021-10-19T15:28:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23449"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/issues/363"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886"
},
{
"type": "PACKAGE",
"url": "https://github.com/patriksimek/vm2"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/releases/tag/3.9.4"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20211029-0010"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-VM2-1585918"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in vm2"
}
GHSA-RMHG-2CVV-Q7VX
Vulnerability from github – Published: 2023-03-06 06:30 – Updated: 2023-03-13 15:28All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "dot-lens"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-26106"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-07T20:32:03Z",
"nvd_published_at": "2023-03-06T05:15:00Z",
"severity": "HIGH"
},
"details": "All versions of the package dot-lens are vulnerable to Prototype Pollution via the `set()` function in `index.js` file.",
"id": "GHSA-rmhg-2cvv-q7vx",
"modified": "2023-03-13T15:28:08Z",
"published": "2023-03-06T06:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26106"
},
{
"type": "PACKAGE",
"url": "https://github.com/jb55/dot-lens"
},
{
"type": "WEB",
"url": "https://github.com/jb55/dot-lens/blob/465ef2088e4065b7be1c4372eedd2215c3820bc4/index.js#23L70"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-DOTLENS-3227646"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "dot-lens vulnerable to Prototype Pollution"
}
GHSA-RMRJ-5WJ3-Q8FR
Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-02-06 18:31A prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
{
"affected": [],
"aliases": [
"CVE-2024-57067"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T22:15:31Z",
"severity": "HIGH"
},
"details": "A prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.",
"id": "GHSA-rmrj-5wj3-q8fr",
"modified": "2025-02-06T18:31:05Z",
"published": "2025-02-06T06:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57067"
},
{
"type": "WEB",
"url": "https://gist.github.com/tariqhawis/07dca101d8fe059dd11b3b0e1b4a6d46"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RPPW-JJG7-2JHR
Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-02-06 18:31A prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
{
"affected": [],
"aliases": [
"CVE-2024-57063"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T22:15:30Z",
"severity": "HIGH"
},
"details": "A prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.",
"id": "GHSA-rppw-jjg7-2jhr",
"modified": "2025-02-06T18:31:05Z",
"published": "2025-02-06T06:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57063"
},
{
"type": "WEB",
"url": "https://gist.github.com/tariqhawis/dcb93b4788273c3ffb15f70dc45ca4e7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RQHX-WX74-955G
Vulnerability from github – Published: 2023-02-23 21:30 – Updated: 2023-03-03 18:30A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.
{
"affected": [],
"aliases": [
"CVE-2023-23917"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-23T20:15:00Z",
"severity": "HIGH"
},
"details": "A prototype pollution vulnerability exists in Rocket.Chat server \u003c5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.",
"id": "GHSA-rqhx-wx74-955g",
"modified": "2023-03-03T18:30:27Z",
"published": "2023-02-23T21:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23917"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1631258"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RRC9-GQF8-8RWG
Vulnerability from github – Published: 2021-11-16 21:26 – Updated: 2021-04-06 20:37This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "aws-sdk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.814.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.0-rc.8"
},
"package": {
"ecosystem": "npm",
"name": "@aws-sdk/shared-ini-file-loader"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0-rc.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-28472"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-06T20:37:10Z",
"nvd_published_at": "2021-01-19T11:15:00Z",
"severity": "HIGH"
},
"details": "This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.",
"id": "GHSA-rrc9-gqf8-8rwg",
"modified": "2021-04-06T20:37:10Z",
"published": "2021-11-16T21:26:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28472"
},
{
"type": "WEB",
"url": "https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611"
},
{
"type": "WEB",
"url": "https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader"
}
GHSA-RRQM-P222-8PH2
Vulnerability from github – Published: 2021-02-08 17:44 – Updated: 2022-05-26 19:58Impact
In Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method lib/utils/object/set.ts. This method is used throughout the codebase for various operations throughout Dynamoose.
We have not seen any evidence of this vulnerability being exploited.
We do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.
Patches
v2.7.0 includes a patch for this vulnerability.
Workarounds
We are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.
References
- Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e
For more information
If you have any questions or comments about this advisory:
Credit
- GitHub CodeQL Code Scanning
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "dynamoose"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21304"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-02-08T17:43:18Z",
"nvd_published_at": "2021-02-08T18:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nIn Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method [`lib/utils/object/set.ts`](https://github.com/dynamoose/dynamoose/blob/master/lib/utils/object/set.ts). This method is used throughout the codebase for various operations throughout Dynamoose.\n\nWe have not seen any evidence of this vulnerability being exploited.\n\nWe do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.\n\n### Patches\n\nv2.7.0 includes a patch for this vulnerability.\n\n### Workarounds\n\nWe are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.\n\n### References\n\n- Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Contact me](https://charlie.fish/contact)\n* [Read our Security Policy](https://github.com/dynamoose/dynamoose/blob/master/SECURITY.md)\n\n### Credit\n\n- GitHub CodeQL Code Scanning",
"id": "GHSA-rrqm-p222-8ph2",
"modified": "2022-05-26T19:58:25Z",
"published": "2021-02-08T17:44:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dynamoose/dynamoose/security/advisories/GHSA-rrqm-p222-8ph2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21304"
},
{
"type": "WEB",
"url": "https://github.com/dynamoose/dynamoose/commit/324c62b4709204955931a187362f8999805b1d8e"
},
{
"type": "PACKAGE",
"url": "https://github.com/dynamoose/dynamoose"
},
{
"type": "WEB",
"url": "https://github.com/dynamoose/dynamoose/releases/tag/v2.7.0"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/dynamoose"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in Dynamoose"
}
GHSA-RV28-58VF-V4PV
Vulnerability from github – Published: 2022-05-13 01:22 – Updated: 2022-05-13 01:22An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.
{
"affected": [],
"aliases": [
"CVE-2019-9058"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-26T17:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.",
"id": "GHSA-rv28-58vf-v4pv",
"modified": "2022-05-13T01:22:59Z",
"published": "2022-05-13T01:22:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9058"
},
{
"type": "WEB",
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"type": "WEB",
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RX8G-88G5-QH64
Vulnerability from github – Published: 2025-09-24 18:30 – Updated: 2025-11-06 18:20A vulnerability exists in the 'min-document' package prior to version 2.19.1, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the proto property, an attacker can manipulate the prototype chain of JavaScript objects, leading to denial of service or arbitrary code execution. This issue arises from insufficient validation of attribute namespace removal operations, allowing unintended modification of critical object prototypes. The vulnerability is addressed in version 2.19.1.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.19.0"
},
"package": {
"ecosystem": "npm",
"name": "min-document"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.19.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-57352"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-29T13:12:07Z",
"nvd_published_at": "2025-09-24T18:15:41Z",
"severity": "LOW"
},
"details": "A vulnerability exists in the \u0027min-document\u0027 package prior to version 2.19.1, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the __proto__ property, an attacker can manipulate the prototype chain of JavaScript objects, leading to denial of service or arbitrary code execution. This issue arises from insufficient validation of attribute namespace removal operations, allowing unintended modification of critical object prototypes. The vulnerability is addressed in version 2.19.1.",
"id": "GHSA-rx8g-88g5-qh64",
"modified": "2025-11-06T18:20:23Z",
"published": "2025-09-24T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57352"
},
{
"type": "WEB",
"url": "https://github.com/Raynos/min-document/issues/54"
},
{
"type": "WEB",
"url": "https://github.com/Raynos/min-document/pull/55"
},
{
"type": "WEB",
"url": "https://github.com/Raynos/min-document/commit/fe32e8da464cef622528725f647029a8fd7d95a6"
},
{
"type": "PACKAGE",
"url": "https://github.com/Raynos/min-document"
},
{
"type": "WEB",
"url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57352"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "min-document vulnerable to prototype pollution"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.