CWE-1321
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)
Monthly
Prototype pollution in `@graphql-tools/utils` (npm) versions >= 10.10.1 through 12.0.1 allows an attacker who controls, compromises, or MITMs the upstream GraphQL transport to write attacker-chosen properties onto `Object.prototype` in the consuming Node.js process. The flaw is in the exported `mergeIncrementalResult` helper: its only guard does strict string equality against `__proto__`, `constructor` and `prototype`, so a non-primitive path segment like `["__proto__"]` passes the check and is then coerced by `ToPropertyKey` during bracket access, redirecting the subsequent assignment onto `Object.prototype`. Reproduction was demonstrated dynamically - source-level, against published npm builds (10.10.0 safe, 10.10.1 through 12.0.1 all succeed), and over the network via a crafted multipart `@defer` response that set `Object.prototype.isAdmin = true` and made a consumer-style `opts.isAdmin === true` check return true on a fresh object. A public proof-of-concept reference exists; its status as verified working exploit code beyond the reporter's own reproductions is not independently confirmed, and there is no CISA KEV listing indicating active exploitation. Risk is conditional: only consumers calling the helper on payloads from an upstream they do not control are exposed, and the project's own production code does not call it.
Prototype pollution in toml-node before 5.0.1 lets an attacker who controls TOML input passed to toml.parse() inject properties into Object.prototype by combining colliding quoted dotted-key bookkeeping with a table-array declaration. The flaw can corrupt objects created elsewhere in the same Node.js or browser process, producing high integrity and availability impact with no confidentiality impact; no public exploit identified at time of analysis.
Prototype pollution in @rvf/set-get before 7.0.4 lets remote attackers crash a Node.js process by submitting a form field named 'hasOwnProperty.call' (or a similar dotted path into an inherited Object.prototype method) through @rvf/core form parsing. Because setPath resolves inherited properties with a plain `obj[part] === undefined` check, it walks into Object.prototype and overwrites the shared built-in function, denying service process-wide until restart. The CVSS 4.0 vector scores 8.7 with PR:N and UI:N, meaning no authentication or user interaction is required; no public exploit code was identified at time of analysis, and the practical scope is limited to applications that route untrusted form input through the vulnerable @rvf parsing stack, with impact confined to a recoverable denial of service rather than code execution or data exposure.
Prototype pollution in n8n's MCP workflow-validation tool allows an authenticated user holding only a workflow:read grant to escalate privileges and take over owner accounts that are not protected by MFA. The flaw affects n8n versions before 2.41.4 and 2.42.x before 2.42.1, and exploitation requires that the MCP validation feature be enabled and reachable so its interpreter can evaluate caller-supplied code in the main process. No public exploit code was identified at time of analysis, and the attack chain - polluting a shared prototype to replace a built-in method that server-side permission checks rely on - is a genuine privilege-escalation priority for exposed instances rather than an internet-wide emergency, since valid low-privilege authentication, feature availability, and the absence of MFA on the target owner account are all prerequisites.
Privilege escalation leading to remote code execution in Xen Orchestra deployments before 6.9.0 lets any authenticated account, regardless of how few permissions it holds, obtain global administrator rights. The vm.importFromEsxi and vm.importMultipleFromEsxi methods lack access-control checks, so an authenticated remote attacker who can make xo-server import from an attacker-controlled ESXi host serving a crafted .vmx file containing a __proto__.permission property pollutes Object.prototype; every permission-less account then inherits admin rights, and that administrative foothold enables remote code execution. The flaw is rated 7.7 (CVSS 4.0, AV:N/AC:H/PR:L) and assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; exploitation requires a valid low-privileged Xen Orchestra account plus control of the ESXi endpoint xo-server connects to, and no public exploit code was identified at time of analysis.
Unauthorized SCIM API access in Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 arises from a shipped default bearer token that the installer and configuration script fail to rotate, enabling remote, unauthenticated attackers who know the token to perform user and group provisioning operations. Chaining this with CVE-2026-61834 in the scim-patch dependency allows server-side prototype pollution and, under Node.js 24/Express with specific gadget chains, remote code execution. The underlying defect is removed in HAS 2026.1; no public exploit code has been identified at time of analysis.
Prototype pollution in dot-access through 1.0.0 allows remote attackers to modify Object.prototype when a consuming application passes an attacker-influenced dotted path to set(). By injecting __proto__ path segments, attackers can alter authorization flags or option defaults across all objects and may crash the process; the flaw is CWE-1321, rated 8.8 in CVSS 4.0, and assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with high integrity and low availability impact. No public exploit identified at time of analysis and no CISA KEV confirmation; exploitation is integration-specific because the path argument must be attacker-controlled.
Prototype pollution in the npm package @stablelib/cbor (versions before 2.0.4) allows an attacker who supplies a CBOR payload to make decoder output inherit attacker-chosen properties, because a map key named "__proto__" is written via bracket assignment and reaches the JavaScript prototype setter instead of creating a normal data property. Applications that pass untrusted CBOR to decode() and then read properties through normal prototype lookup, or merge the decoded object into configuration, authorization or feature-flag state, can act on inherited attacker values - the upstream GHSA includes a working proof-of-concept, so publicly available exploit code exists, but there is no KEV listing and no confirmed active exploitation. Impact is conditional and integrity-only (no confidentiality or availability loss), and the independently assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N rates it below the vendor-supplied 8.9 CVSS 4.0 score because exploitation depends on that specific downstream consumption pattern.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker submit prototype-sensitive field paths to the plugin's endpoints, corrupting object prototypes and triggering unintended application behavior that can escalate to remote code execution. The flaw affects Payload 3.0.0 through versions before 3.88.0 and 4.0.0-canary.0 through versions before 4.0.0-canary.27, but only when the Import Export plugin is installed and enabled - sites without that plugin are unaffected. No public exploit code has been identified at time of analysis, and exploitation is gated by the presence of a reachable prototype-pollution gadget in the target application, so real-world impact is conditional even though the vendor advisory and a 9.3 CVSS 4.0 score (independent assessment: CVSS 3.1 8.1-range with AC:H) both flag it as high severity.
Prototype pollution in `@graphql-tools/utils` (npm) versions >= 10.10.1 through 12.0.1 allows an attacker who controls, compromises, or MITMs the upstream GraphQL transport to write attacker-chosen properties onto `Object.prototype` in the consuming Node.js process. The flaw is in the exported `mergeIncrementalResult` helper: its only guard does strict string equality against `__proto__`, `constructor` and `prototype`, so a non-primitive path segment like `["__proto__"]` passes the check and is then coerced by `ToPropertyKey` during bracket access, redirecting the subsequent assignment onto `Object.prototype`. Reproduction was demonstrated dynamically - source-level, against published npm builds (10.10.0 safe, 10.10.1 through 12.0.1 all succeed), and over the network via a crafted multipart `@defer` response that set `Object.prototype.isAdmin = true` and made a consumer-style `opts.isAdmin === true` check return true on a fresh object. A public proof-of-concept reference exists; its status as verified working exploit code beyond the reporter's own reproductions is not independently confirmed, and there is no CISA KEV listing indicating active exploitation. Risk is conditional: only consumers calling the helper on payloads from an upstream they do not control are exposed, and the project's own production code does not call it.
Prototype pollution in toml-node before 5.0.1 lets an attacker who controls TOML input passed to toml.parse() inject properties into Object.prototype by combining colliding quoted dotted-key bookkeeping with a table-array declaration. The flaw can corrupt objects created elsewhere in the same Node.js or browser process, producing high integrity and availability impact with no confidentiality impact; no public exploit identified at time of analysis.
Prototype pollution in @rvf/set-get before 7.0.4 lets remote attackers crash a Node.js process by submitting a form field named 'hasOwnProperty.call' (or a similar dotted path into an inherited Object.prototype method) through @rvf/core form parsing. Because setPath resolves inherited properties with a plain `obj[part] === undefined` check, it walks into Object.prototype and overwrites the shared built-in function, denying service process-wide until restart. The CVSS 4.0 vector scores 8.7 with PR:N and UI:N, meaning no authentication or user interaction is required; no public exploit code was identified at time of analysis, and the practical scope is limited to applications that route untrusted form input through the vulnerable @rvf parsing stack, with impact confined to a recoverable denial of service rather than code execution or data exposure.
Prototype pollution in n8n's MCP workflow-validation tool allows an authenticated user holding only a workflow:read grant to escalate privileges and take over owner accounts that are not protected by MFA. The flaw affects n8n versions before 2.41.4 and 2.42.x before 2.42.1, and exploitation requires that the MCP validation feature be enabled and reachable so its interpreter can evaluate caller-supplied code in the main process. No public exploit code was identified at time of analysis, and the attack chain - polluting a shared prototype to replace a built-in method that server-side permission checks rely on - is a genuine privilege-escalation priority for exposed instances rather than an internet-wide emergency, since valid low-privilege authentication, feature availability, and the absence of MFA on the target owner account are all prerequisites.
Privilege escalation leading to remote code execution in Xen Orchestra deployments before 6.9.0 lets any authenticated account, regardless of how few permissions it holds, obtain global administrator rights. The vm.importFromEsxi and vm.importMultipleFromEsxi methods lack access-control checks, so an authenticated remote attacker who can make xo-server import from an attacker-controlled ESXi host serving a crafted .vmx file containing a __proto__.permission property pollutes Object.prototype; every permission-less account then inherits admin rights, and that administrative foothold enables remote code execution. The flaw is rated 7.7 (CVSS 4.0, AV:N/AC:H/PR:L) and assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; exploitation requires a valid low-privileged Xen Orchestra account plus control of the ESXi endpoint xo-server connects to, and no public exploit code was identified at time of analysis.
Unauthorized SCIM API access in Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 arises from a shipped default bearer token that the installer and configuration script fail to rotate, enabling remote, unauthenticated attackers who know the token to perform user and group provisioning operations. Chaining this with CVE-2026-61834 in the scim-patch dependency allows server-side prototype pollution and, under Node.js 24/Express with specific gadget chains, remote code execution. The underlying defect is removed in HAS 2026.1; no public exploit code has been identified at time of analysis.
Prototype pollution in dot-access through 1.0.0 allows remote attackers to modify Object.prototype when a consuming application passes an attacker-influenced dotted path to set(). By injecting __proto__ path segments, attackers can alter authorization flags or option defaults across all objects and may crash the process; the flaw is CWE-1321, rated 8.8 in CVSS 4.0, and assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with high integrity and low availability impact. No public exploit identified at time of analysis and no CISA KEV confirmation; exploitation is integration-specific because the path argument must be attacker-controlled.
Prototype pollution in the npm package @stablelib/cbor (versions before 2.0.4) allows an attacker who supplies a CBOR payload to make decoder output inherit attacker-chosen properties, because a map key named "__proto__" is written via bracket assignment and reaches the JavaScript prototype setter instead of creating a normal data property. Applications that pass untrusted CBOR to decode() and then read properties through normal prototype lookup, or merge the decoded object into configuration, authorization or feature-flag state, can act on inherited attacker values - the upstream GHSA includes a working proof-of-concept, so publicly available exploit code exists, but there is no KEV listing and no confirmed active exploitation. Impact is conditional and integrity-only (no confidentiality or availability loss), and the independently assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N rates it below the vendor-supplied 8.9 CVSS 4.0 score because exploitation depends on that specific downstream consumption pattern.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker submit prototype-sensitive field paths to the plugin's endpoints, corrupting object prototypes and triggering unintended application behavior that can escalate to remote code execution. The flaw affects Payload 3.0.0 through versions before 3.88.0 and 4.0.0-canary.0 through versions before 4.0.0-canary.27, but only when the Import Export plugin is installed and enabled - sites without that plugin are unaffected. No public exploit code has been identified at time of analysis, and exploitation is gated by the presence of a reachable prototype-pollution gadget in the target application, so real-world impact is conditional even though the vendor advisory and a 9.3 CVSS 4.0 score (independent assessment: CVSS 3.1 8.1-range with AC:H) both flag it as high severity.