CWE-1321
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)
Monthly
Remote code execution in sift.js 17.1.3 arises because the library enumerates query keys with for...in, which traverses the prototype chain, and dispatches the $where operator by compiling its string value via new Function whenever CSP_ENABLED is unset (the default). An attacker who can either supply an untrusted query object containing a string $where, or who has established a prototype-pollution primitive elsewhere in the process (setting Object.prototype.$where), achieves arbitrary JavaScript execution - in the pollution case even benign calls like sift({}) trigger it. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory documents the mechanism in detail.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Prototype pollution in node-csv's csv-parse package (prior to 7.0.2) allows unauthenticated remote attackers to inject inherited array values into parsed record objects by supplying a CSV with duplicate __proto__ column headers when both the columns and group_columns_by_name options are enabled. The parser's direct obj['__proto__'] assignment replaces the parsed record's prototype with an attacker-controlled array, causing inherited numeric-index values to be silently hidden from JSON.stringify(), corrupt property enumeration, and subvert type or shape checks in downstream application logic. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 7.0.2.
Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. Depending on the downstream dependency tree, exploitable outcomes range from reliable denial of service to remote code execution via prototype-pollution gadget chains; no public exploit or active exploitation is confirmed at time of analysis.
Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0.0 through <17.13.6 and <18.2.5, and @hapi/joi through 17.1.1), allows an attacker who can supply attacker-controlled language keys to joi's schema-construction message API to write arbitrary properties onto Object.prototype or the Object constructor's static properties. A language key named __proto__ contaminates the global prototype, causing every subsequent property-existence check on any plain object in the process to return an unexpected value, silently flipping conditional logic. No public exploit has been identified at time of analysis, exploitation conditions are restrictive, and the vendor has released fixed versions 17.13.6 and 18.2.5.
Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prototype of the object returned by validate(), but does not affect global Object.prototype. When a schema combines a regex rename source, a Joi.x() or Joi.expression() interpolating template target, and { multiple: true }, an input key such as x-__proto__ causes the rename target to resolve to __proto__, which JavaScript interprets as a prototype assignment rather than own-property creation. The scope is strictly confined to the single validation call result - downstream code that reads prototype-inherited properties on that object could observe attacker-injected values, enabling potential within-request privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; CVSS 3.7 (AC:H) accurately reflects the tight, non-default schema configuration required.
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from JavaScript object prototypes by supplying crafted, user-controlled file input path names. Affected versions are all @sveltejs/kit releases up to and including 2.69.0; the vendor released a fix in 2.69.1. No active exploitation is documented in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is network-reachable and requires no authentication from the attacker.
Prototype pollution in the `@cleverbrush/deep` package (versions ≤ 4.4.0) allows a remote attacker to corrupt `Object.prototype` by supplying crafted JSON containing reserved JavaScript keys (`__proto__`, `constructor`, `prototype`) to the `deepExtend()` function without any privilege requirement. Any Node.js application that passes externally controlled input through `deepExtend()` is at risk of property injection affecting every plain object in the runtime, potentially enabling authentication bypass or logic manipulation downstream. A public exploit exists (GitHub issue #213); the vulnerability is not listed in CISA KEV, so widespread active exploitation is not confirmed at time of analysis.
Prototype pollution in ractivejs/ractive through version 1.4.4 allows remote attackers to modify JavaScript Object.prototype attributes via the Ractive#set function's Keypath Handler component. A publicly available proof-of-concept exists (GitHub issue #3448), and the maintainers have not yet responded to the coordinated disclosure. No vendor-released patch is available at time of analysis, leaving all users of the 1.4.x branch exposed with no official remediation path.
Prototype pollution in alibaba-fusion/next (all versions through 1.27.34) allows remote unauthenticated attackers to inject arbitrary properties into Object.prototype by supplying crafted values to the locale argument processed by the deepMerge function inside ConfigProvider.getContextProps within the Dialog component. The attack is network-reachable with no authentication or user interaction required per the CVSS 4.0 vector, though real-world exploitation depends on attacker-controlled data reaching the locale prop. No patch has been released and the upstream GitHub issue was closed due to inactivity; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in sift.js 17.1.3 arises because the library enumerates query keys with for...in, which traverses the prototype chain, and dispatches the $where operator by compiling its string value via new Function whenever CSP_ENABLED is unset (the default). An attacker who can either supply an untrusted query object containing a string $where, or who has established a prototype-pollution primitive elsewhere in the process (setting Object.prototype.$where), achieves arbitrary JavaScript execution - in the pollution case even benign calls like sift({}) trigger it. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory documents the mechanism in detail.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Prototype pollution in node-csv's csv-parse package (prior to 7.0.2) allows unauthenticated remote attackers to inject inherited array values into parsed record objects by supplying a CSV with duplicate __proto__ column headers when both the columns and group_columns_by_name options are enabled. The parser's direct obj['__proto__'] assignment replaces the parsed record's prototype with an attacker-controlled array, causing inherited numeric-index values to be silently hidden from JSON.stringify(), corrupt property enumeration, and subvert type or shape checks in downstream application logic. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 7.0.2.
Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. Depending on the downstream dependency tree, exploitable outcomes range from reliable denial of service to remote code execution via prototype-pollution gadget chains; no public exploit or active exploitation is confirmed at time of analysis.
Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0.0 through <17.13.6 and <18.2.5, and @hapi/joi through 17.1.1), allows an attacker who can supply attacker-controlled language keys to joi's schema-construction message API to write arbitrary properties onto Object.prototype or the Object constructor's static properties. A language key named __proto__ contaminates the global prototype, causing every subsequent property-existence check on any plain object in the process to return an unexpected value, silently flipping conditional logic. No public exploit has been identified at time of analysis, exploitation conditions are restrictive, and the vendor has released fixed versions 17.13.6 and 18.2.5.
Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prototype of the object returned by validate(), but does not affect global Object.prototype. When a schema combines a regex rename source, a Joi.x() or Joi.expression() interpolating template target, and { multiple: true }, an input key such as x-__proto__ causes the rename target to resolve to __proto__, which JavaScript interprets as a prototype assignment rather than own-property creation. The scope is strictly confined to the single validation call result - downstream code that reads prototype-inherited properties on that object could observe attacker-injected values, enabling potential within-request privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; CVSS 3.7 (AC:H) accurately reflects the tight, non-default schema configuration required.
Prototype pollution in SvelteKit's remote form functions allows network-accessible attackers to remove methods from JavaScript object prototypes by supplying crafted, user-controlled file input path names. Affected versions are all @sveltejs/kit releases up to and including 2.69.0; the vendor released a fix in 2.69.1. No active exploitation is documented in CISA KEV, and no public exploit code has been identified at time of analysis, though the vulnerability is network-reachable and requires no authentication from the attacker.
Prototype pollution in the `@cleverbrush/deep` package (versions ≤ 4.4.0) allows a remote attacker to corrupt `Object.prototype` by supplying crafted JSON containing reserved JavaScript keys (`__proto__`, `constructor`, `prototype`) to the `deepExtend()` function without any privilege requirement. Any Node.js application that passes externally controlled input through `deepExtend()` is at risk of property injection affecting every plain object in the runtime, potentially enabling authentication bypass or logic manipulation downstream. A public exploit exists (GitHub issue #213); the vulnerability is not listed in CISA KEV, so widespread active exploitation is not confirmed at time of analysis.
Prototype pollution in ractivejs/ractive through version 1.4.4 allows remote attackers to modify JavaScript Object.prototype attributes via the Ractive#set function's Keypath Handler component. A publicly available proof-of-concept exists (GitHub issue #3448), and the maintainers have not yet responded to the coordinated disclosure. No vendor-released patch is available at time of analysis, leaving all users of the 1.4.x branch exposed with no official remediation path.
Prototype pollution in alibaba-fusion/next (all versions through 1.27.34) allows remote unauthenticated attackers to inject arbitrary properties into Object.prototype by supplying crafted values to the locale argument processed by the deepMerge function inside ConfigProvider.getContextProps within the Dialog component. The attack is network-reachable with no authentication or user interaction required per the CVSS 4.0 vector, though real-world exploitation depends on attacker-controlled data reaching the locale prop. No patch has been released and the upstream GitHub issue was closed due to inactivity; no public exploit code or CISA KEV listing has been identified at time of analysis.