CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (page 2)
Page 2 of 6 — CVEs classified under CWE-1321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33228 | Critical | 9.8 | 2026-03-20 | flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as di… |
CVE-2026-32701 | High | 7.5 | 2026-03-20 | Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. B… |
CVE-2026-32886 | High | 7.5 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can… |
CVE-2026-32878 | High | 7.5 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.20 and 8.6.44, an attacker can byp… |
CVE-2026-31865 | Medium | 6.5 | 2026-03-18 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an El… |
CVE-2026-27524 | Medium | 4.3 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authori… |
CVE-2026-4239 | Low | 3.5 | 2026-03-16 | A vulnerability was found in Lagom WHMCS Template up to 2.3.7. Impacted is an unknown function of the component Datatables. The manipulation results in imprope… |
CVE-2026-32621 | Critical | 9.9 | 2026-03-16 | Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability… |
CVE-2026-30226 | High | 7.5 | 2026-03-11 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, dev… |
CVE-2026-30939 | High | 7.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated a… |
CVE-2026-29063 | Critical | 9.8 | 2026-03-06 | Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via th… |
CVE-2026-28794 | Critical | 9.8 | 2026-03-06 | oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerabili… |
CVE-2026-30785 | Medium | 5.5 | 2026-03-05 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerab… |
CVE-2026-27837 | Medium | 6.3 | 2026-02-26 | Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype p… |
CVE-2026-2964 | Medium | 5.0 | 2026-02-23 | A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the compone… |
CVE-2026-27212 | High | 7.8 | 2026-02-21 | Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vu… |
CVE-2025-70956 | High | 7.5 | 2026-02-13 | A State Pollution vulnerability was discovered in the TON Virtual Machine (TVM) before v2025.04. The issue exists in the RUNVM instruction logic (VmState::run_… |
CVE-2026-26021 | Critical | 9.8 | 2026-02-11 | set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=… |
CVE-2026-25881 | Critical | 9.0 | 2026-02-09 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laund… |
CVE-2026-25754 | High | 7.2 | 2026-02-06 | AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data p… |
CVE-2026-25521 | High | 8.8 | 2026-02-04 | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution v… |
CVE-2026-25150 | Critical | 9.3 | 2026-02-03 | Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @bui… |
CVE-2026-25142 | Critical | 10.0 | 2026-02-02 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, whi… |
CVE-2026-25047 | High | 8.8 | 2026-01-29 | deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 o… |
CVE-2026-24888 | Medium | 6.5 | 2026-01-28 | Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function… |
CVE-2026-24766 | Medium | 4.9 | 2026-01-28 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit proto… |
CVE-2025-61140 | Critical | 9.8 | 2026-01-28 | The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. |
CVE-2026-23736 | High | 7.3 | 2026-01-21 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper inp… |
CVE-2025-13465 | Medium | 5.3 | 2026-01-21 | Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause… |
CVE-2026-21854 | Critical | 9.8 | 2026-01-07 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows… |
CVE-2024-14020 | Medium | 5.0 | 2026-01-07 | A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js o… |
CVE-2025-13158 | | 2025-12-26 | Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via… | |
CVE-2025-68130 | | 2025-12-16 | tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11… | |
CVE-2025-8083 | High | 8.6 | 2025-12-12 | The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp… |
CVE-2025-66456 | Critical | 9.8 | 2025-12-09 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 c… |
CVE-2025-13204 | High | 7.3 | 2025-11-14 | npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance… |
CVE-2025-64718 | Medium | 5.3 | 2025-11-13 | js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a pa… |
CVE-2025-62517 | Medium | 5.9 | 2025-10-23 | Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prot… |
CVE-2025-62410 | | 2025-10-15 | In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The unt… | |
CVE-2025-62381 | | 2025-10-15 | sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability wit… | |
CVE-2025-62374 | Medium | 6.4 | 2025-10-14 | Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attac… |
CVE-2025-3193 | High | 7.5 | 2025-09-27 | Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which… |
CVE-2025-26278 | High | 7.5 | 2025-09-25 | A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2025-57324 | Medium | 6.5 | 2025-09-24 | parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse… |
CVE-2025-57320 | Medium | 6.5 | 2025-09-24 | json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-sche… |
CVE-2025-57318 | High | 7.5 | 2025-09-24 | A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.prototype via supplyin… |
CVE-2025-57329 | High | 7.5 | 2025-09-24 | web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-c… |
CVE-2025-57328 | High | 7.5 | 2025-09-24 | toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objects. A Prototype P… |
CVE-2025-57327 | High | 7.5 | 2025-09-24 | spmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc version 1.2.0 and before a… |
CVE-2025-57326 | High | 7.5 | 2025-09-24 | A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototyp… |
CVE-2025-57325 | High | 7.5 | 2025-09-24 | rollbar is a package designed to effortlessly track and debug errors in JavaScript applications. This package includes advanced error tracking features and an… |
CVE-2025-57323 | High | 7.5 | 2025-09-24 | mpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mp.addEventHandler fu… |
CVE-2025-57321 | Critical | 9.8 | 2025-09-24 | A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to inject properties on O… |
CVE-2025-57351 | Medium | 6.5 | 2025-09-24 | A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided keys in the assign fu… |
CVE-2025-57349 | High | 7.5 | 2025-09-24 | The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper… |
CVE-2025-57348 | Medium | 6.5 | 2025-09-24 | The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allow an attacker to inj… |
CVE-2025-57347 | Critical | 9.8 | 2025-09-24 | A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly… |
CVE-2025-57330 | High | 7.5 | 2025-09-24 | The web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in the attachToObject function of web3-cor… |
CVE-2025-57354 | Medium | 6.5 | 2025-09-24 | A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key pr… |
CVE-2025-57353 | Medium | 5.3 | 2025-09-24 | The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested… |
CVE-2025-57352 | Medium | 5.3 | 2025-09-24 | A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttributeNS… |
CVE-2025-57350 | High | 8.6 | 2025-09-24 | The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions… |
CVE-2025-58280 | High | 8.4 | 2025-09-05 | Vulnerability of exposing object heap addresses in the Ark eTS module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-57820 | | 2025-08-26 | Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.p… | |
CVE-2025-55195 | High | 7.3 | 2025-08-14 | @std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrust… |
CVE-2011-10019 | Critical | 9.8 | 2025-08-13 | Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitiz… |
CVE-2025-55164 | | 2025-08-12 | content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if… | |
CVE-2025-54803 | High | 7.5 | 2025-08-05 | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allo… |
CVE-2025-34146 | | 2025-07-31 | A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via… | |
CVE-2025-8101 | | 2025-07-25 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attrib… | |
CVE-2025-53626 | Medium | 6.1 | 2025-07-10 | pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allow… |
CVE-2024-57708 | Medium | 5.7 | 2025-06-25 | An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components… |
CVE-2025-49223 | Critical | 9.8 | 2025-06-04 | billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or… |
CVE-2025-48054 | | 2025-05-27 | Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pollution. If an attac… | |
CVE-2025-5150 | Medium | 6.3 | 2025-05-25 | A vulnerability was found in docarray up to 0.40.1. It has been rated as critical. Affected by this issue is the function __getitem__ of the file /docarray/dat… |
CVE-2025-26621 | High | 7.6 | 2025-05-19 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manag… |
CVE-2025-25014 | Critical | 9.1 | 2025-05-06 | A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. |
CVE-2025-3982 | Medium | 4.3 | 2025-04-27 | A vulnerability, which was classified as problematic, was found in nortikin Sverchok 1.3.0. Affected is the function SvSetPropNodeMK2 of the file sverchok/node… |
CVE-2024-12556 | High | 8.7 | 2025-04-08 | Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. |
CVE-2025-32014 | | 2025-04-07 | estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named __proto__, valueT… | |
CVE-2025-31475 | Medium | 5.5 | 2025-04-07 | tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate functio… |
CVE-2025-3197 | High | 7.3 | 2025-04-04 | Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given st… |
CVE-2024-57083 | High | 7.5 | 2025-03-28 | A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS)… |
CVE-2024-38988 | Critical | 9.8 | 2025-03-28 | alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerability allows attacke… |
CVE-2024-38985 | Critical | 9.8 | 2025-03-28 | janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vu… |
CVE-2024-24292 | Critical | 9.8 | 2025-03-28 | A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component. |
CVE-2025-25977 | Critical | 9.8 | 2025-03-10 | An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement. |
CVE-2025-27597 | | 2025-03-07 | Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the… | |
CVE-2025-25015 | Critical | 9.9 | 2025-03-05 | Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0… |
CVE-2024-11628 | Medium | 4.1 | 2025-02-12 | In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which c… |
CVE-2024-12629 | Medium | 4.1 | 2025-02-12 | In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can res… |
CVE-2024-57086 | High | 7.5 | 2025-02-05 | A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoS) via supplying a c… |
CVE-2024-57084 | High | 7.5 | 2025-02-05 | A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57080 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57078 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57077 | Critical | 9.1 | 2025-02-05 | The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with… |
CVE-2024-57072 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service (DoS) via supplying a cr… |
CVE-2024-57071 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57069 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2024-57067 | High | 7.5 | 2025-02-05 | A prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |