CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (page 2)
Page 2 of 6 — CVEs classified under CWE-1321, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46625 | High | 7.5 | 2026-06-10 | JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with fo… |
CVE-2026-45302 | High | 8.2 | 2026-06-01 | parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and do… |
CVE-2026-46510 | High | 8.2 | 2026-05-29 | form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects wi… |
CVE-2026-46509 | High | 8.2 | 2026-05-28 | deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor… |
CVE-2026-44483 | High | 8.2 | 2026-05-27 | RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get… |
CVE-2026-44966 | High | 8.3 | 2026-05-26 | Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in… |
CVE-2026-9101 | Medium | 4.3 | 2026-05-20 | Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user beh… |
CVE-2026-8657 | High | 8.2 | 2026-05-16 | Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.p… |
CVE-2026-44005 | Critical | 10.0 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forw… |
CVE-2026-44292 | Medium | 5.3 | 2026-05-13 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable… |
CVE-2026-44290 | High | 7.5 | 2026-05-13 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse t… |
CVE-2026-8161 | High | 7.5 | 2026-05-12 | multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that… |
CVE-2026-41690 | High | 8.6 | 2026-05-08 | 18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unaut… |
CVE-2026-42264 | High | 7.4 | 2026-05-08 | Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPa… |
CVE-2025-63704 | Critical | 9.8 | 2026-05-07 | NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges th… |
CVE-2025-63703 | Critical | 9.8 | 2026-05-07 | npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js(). |
CVE-2026-42232 | High | 8.8 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify w… |
CVE-2026-42231 | High | 8.8 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodi… |
CVE-2026-42077 | Medium | 5.2 | 2026-05-04 | Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows at… |
CVE-2026-42044 | Medium | 6.5 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget"… |
CVE-2026-42041 | Medium | 4.8 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget"… |
CVE-2026-42035 | High | 7.4 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (li… |
CVE-2026-42033 | High | 7.4 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with… |
CVE-2026-41238 | Medium | 6.9 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XS… |
CVE-2026-6621 | High | 7.3 | 2026-04-20 | A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the a… |
CVE-2026-6594 | High | 7.3 | 2026-04-20 | A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument __proto__/constructor.proto… |
CVE-2026-34626 | Medium | 6.3 | 2026-04-14 | Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attribut… |
CVE-2026-34622 | High | 8.6 | 2026-04-14 | Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attribut… |
CVE-2026-34621 | High | 8.6 | 2026-04-11 | Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype… |
CVE-2026-40190 | Medium | 5.6 | 2026-04-10 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains… |
CVE-2026-35209 | High | 7.5 | 2026-04-06 | defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed… |
CVE-2026-2950 | Medium | 6.5 | 2026-03-31 | Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://gi… |
CVE-2026-34221 | Critical | 9.1 | 2026-03-31 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollutio… |
CVE-2026-33994 | Critical | 9.8 | 2026-03-27 | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototy… |
CVE-2026-33993 | Critical | 9.8 | 2026-03-27 | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus… |
CVE-2026-33916 | Medium | 4.7 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime re… |
CVE-2026-33672 | Medium | 5.3 | 2026-03-26 | Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POS… |
CVE-2026-33696 | High | 8.8 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with permission to create or modify w… |
CVE-2026-33228 | Critical | 9.8 | 2026-03-20 | flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as di… |
CVE-2026-32701 | High | 7.5 | 2026-03-20 | Qwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData parsing. B… |
CVE-2026-32886 | High | 7.5 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can… |
CVE-2026-32878 | High | 7.5 | 2026-03-18 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.20 and 8.6.44, an attacker can byp… |
CVE-2026-31865 | Medium | 6.5 | 2026-03-18 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an El… |
CVE-2026-27524 | Medium | 4.3 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks. Authori… |
CVE-2026-4239 | Low | 3.5 | 2026-03-16 | A vulnerability was found in Lagom WHMCS Template up to 2.3.7. Impacted is an unknown function of the component Datatables. The manipulation results in imprope… |
CVE-2026-32621 | Critical | 9.9 | 2026-03-16 | Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Prior to 2.9.6, 2.10.5, 2.11.6, 2.12.3, and 2.13.2, a vulnerability… |
CVE-2026-30226 | High | 7.5 | 2026-03-11 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, dev… |
CVE-2026-30939 | High | 7.5 | 2026-03-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated a… |
CVE-2026-29063 | Critical | 9.8 | 2026-03-06 | Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via th… |
CVE-2026-28794 | Critical | 9.8 | 2026-03-06 | oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerabili… |
CVE-2026-30785 | Medium | 5.5 | 2026-03-05 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerab… |
CVE-2026-27837 | Medium | 6.3 | 2026-02-26 | Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype p… |
CVE-2026-2964 | Medium | 5.0 | 2026-02-23 | A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the compone… |
CVE-2026-27212 | High | 7.8 | 2026-02-21 | Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vu… |
CVE-2025-70956 | High | 7.5 | 2026-02-13 | A State Pollution vulnerability was discovered in the TON Virtual Machine (TVM) before v2025.04. The issue exists in the RUNVM instruction logic (VmState::run_… |
CVE-2026-26021 | Critical | 9.8 | 2026-02-11 | set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in (>=… |
CVE-2026-25881 | Critical | 9.0 | 2026-02-09 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laund… |
CVE-2026-25754 | High | 7.2 | 2026-02-06 | AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerability in AdonisJS multipart form-data p… |
CVE-2026-25521 | High | 8.8 | 2026-02-04 | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution v… |
CVE-2026-25150 | Critical | 9.3 | 2026-02-03 | Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @bui… |
CVE-2026-25142 | Critical | 10.0 | 2026-02-02 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, whi… |
CVE-2026-25047 | High | 8.8 | 2026-01-29 | deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 o… |
CVE-2026-24888 | Medium | 6.5 | 2026-01-28 | Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the `makerjs.extendObject` function… |
CVE-2026-24766 | Medium | 4.9 | 2026-01-28 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit proto… |
CVE-2025-61140 | Critical | 9.8 | 2026-01-28 | The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. |
CVE-2026-23736 | High | 7.3 | 2026-01-21 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper inp… |
CVE-2025-13465 | Medium | 5.3 | 2026-01-21 | Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause… |
CVE-2026-21854 | Critical | 9.8 | 2026-01-07 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vulnerability in the login endpoint allows… |
CVE-2024-14020 | Medium | 5.0 | 2026-01-07 | A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js o… |
CVE-2025-13158 | | 2025-12-26 | Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via… | |
CVE-2025-68130 | | 2025-12-16 | tRPC allows users to build and consume fully typesafe APIs without schemas or code generation. Starting in version 10.27.0 and prior to versions 10.45.3 and 11… | |
CVE-2025-8083 | High | 8.6 | 2025-12-12 | The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp… |
CVE-2025-66456 | Critical | 9.8 | 2025-12-09 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 c… |
CVE-2025-13204 | High | 7.3 | 2025-11-14 | npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance… |
CVE-2025-64718 | Medium | 5.3 | 2025-11-13 | js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a pa… |
CVE-2025-62517 | Medium | 5.9 | 2025-10-23 | Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prot… |
CVE-2025-62410 | | 2025-10-15 | In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The unt… | |
CVE-2025-62381 | | 2025-10-15 | sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability wit… | |
CVE-2025-62374 | Medium | 6.4 | 2025-10-14 | Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attac… |
CVE-2025-3193 | High | 7.5 | 2025-09-27 | Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which… |
CVE-2025-26278 | High | 7.5 | 2025-09-25 | A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. |
CVE-2025-57324 | Medium | 6.5 | 2025-09-24 | parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse… |
CVE-2025-57320 | Medium | 6.5 | 2025-09-24 | json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-sche… |
CVE-2025-57318 | High | 7.5 | 2025-09-24 | A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.prototype via supplyin… |
CVE-2025-57329 | High | 7.5 | 2025-09-24 | web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-c… |
CVE-2025-57328 | High | 7.5 | 2025-09-24 | toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objects. A Prototype P… |
CVE-2025-57327 | High | 7.5 | 2025-09-24 | spmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc version 1.2.0 and before a… |
CVE-2025-57326 | High | 7.5 | 2025-09-24 | A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototyp… |
CVE-2025-57325 | High | 7.5 | 2025-09-24 | rollbar is a package designed to effortlessly track and debug errors in JavaScript applications. This package includes advanced error tracking features and an… |
CVE-2025-57323 | High | 7.5 | 2025-09-24 | mpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mp.addEventHandler fu… |
CVE-2025-57321 | Critical | 9.8 | 2025-09-24 | A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to inject properties on O… |
CVE-2025-57351 | Medium | 6.5 | 2025-09-24 | A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided keys in the assign fu… |
CVE-2025-57349 | High | 7.5 | 2025-09-24 | The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper… |
CVE-2025-57348 | Medium | 6.5 | 2025-09-24 | The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allow an attacker to inj… |
CVE-2025-57347 | Critical | 9.8 | 2025-09-24 | A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly… |
CVE-2025-57330 | High | 7.5 | 2025-09-24 | The web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in the attachToObject function of web3-cor… |
CVE-2025-57354 | Medium | 6.5 | 2025-09-24 | A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key pr… |
CVE-2025-57353 | Medium | 5.3 | 2025-09-24 | The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested… |
CVE-2025-57352 | Medium | 5.3 | 2025-09-24 | A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttributeNS… |
CVE-2025-57350 | High | 8.6 | 2025-09-24 | The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions… |