Prototype Pollution
Monthly
Prototype pollution in n8n's MCP workflow-validation tool allows an authenticated user holding only a workflow:read grant to escalate privileges and take over owner accounts that are not protected by MFA. The flaw affects n8n versions before 2.41.4 and 2.42.x before 2.42.1, and exploitation requires that the MCP validation feature be enabled and reachable so its interpreter can evaluate caller-supplied code in the main process. No public exploit code was identified at time of analysis, and the attack chain - polluting a shared prototype to replace a built-in method that server-side permission checks rely on - is a genuine privilege-escalation priority for exposed instances rather than an internet-wide emergency, since valid low-privilege authentication, feature availability, and the absence of MFA on the target owner account are all prerequisites.
Privilege escalation leading to remote code execution in Xen Orchestra deployments before 6.9.0 lets any authenticated account, regardless of how few permissions it holds, obtain global administrator rights. The vm.importFromEsxi and vm.importMultipleFromEsxi methods lack access-control checks, so an authenticated remote attacker who can make xo-server import from an attacker-controlled ESXi host serving a crafted .vmx file containing a __proto__.permission property pollutes Object.prototype; every permission-less account then inherits admin rights, and that administrative foothold enables remote code execution. The flaw is rated 7.7 (CVSS 4.0, AV:N/AC:H/PR:L) and assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; exploitation requires a valid low-privileged Xen Orchestra account plus control of the ESXi endpoint xo-server connects to, and no public exploit code was identified at time of analysis.
Unauthorized SCIM API access in Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 arises from a shipped default bearer token that the installer and configuration script fail to rotate, enabling remote, unauthenticated attackers who know the token to perform user and group provisioning operations. Chaining this with CVE-2026-61834 in the scim-patch dependency allows server-side prototype pollution and, under Node.js 24/Express with specific gadget chains, remote code execution. The underlying defect is removed in HAS 2026.1; no public exploit code has been identified at time of analysis.
Prototype pollution in dot-access through 1.0.0 allows remote attackers to modify Object.prototype when a consuming application passes an attacker-influenced dotted path to set(). By injecting __proto__ path segments, attackers can alter authorization flags or option defaults across all objects and may crash the process; the flaw is CWE-1321, rated 8.8 in CVSS 4.0, and assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with high integrity and low availability impact. No public exploit identified at time of analysis and no CISA KEV confirmation; exploitation is integration-specific because the path argument must be attacker-controlled.
Prototype pollution in the npm package @stablelib/cbor (versions before 2.0.4) allows an attacker who supplies a CBOR payload to make decoder output inherit attacker-chosen properties, because a map key named "__proto__" is written via bracket assignment and reaches the JavaScript prototype setter instead of creating a normal data property. Applications that pass untrusted CBOR to decode() and then read properties through normal prototype lookup, or merge the decoded object into configuration, authorization or feature-flag state, can act on inherited attacker values - the upstream GHSA includes a working proof-of-concept, so publicly available exploit code exists, but there is no KEV listing and no confirmed active exploitation. Impact is conditional and integrity-only (no confidentiality or availability loss), and the independently assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N rates it below the vendor-supplied 8.9 CVSS 4.0 score because exploitation depends on that specific downstream consumption pattern.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker submit prototype-sensitive field paths to the plugin's endpoints, corrupting object prototypes and triggering unintended application behavior that can escalate to remote code execution. The flaw affects Payload 3.0.0 through versions before 3.88.0 and 4.0.0-canary.0 through versions before 4.0.0-canary.27, but only when the Import Export plugin is installed and enabled - sites without that plugin are unaffected. No public exploit code has been identified at time of analysis, and exploitation is gated by the presence of a reachable prototype-pollution gadget in the target application, so real-world impact is conditional even though the vendor advisory and a 9.3 CVSS 4.0 score (independent assessment: CVSS 3.1 8.1-range with AC:H) both flag it as high severity.
Prototype pollution in `@graphql-tools/utils` `mergeDeep()` lets a remote, unauthenticated client submit a single aliased GraphQL query that overwrites inherited JavaScript built-ins such as `Function.prototype.call`, causing denial of service against the gateway or schema-stitching service until it is restarted. Only deployments built on @graphql-tools/utils <= 12.0.0 that actually merge objects returned from two subgraphs (the ordinary `@shareable` field or cross-subgraph entity case, e.g. Hive Gateway) invoke the vulnerable code path; single-subgraph servers are not affected. Both CVSS 4.0 (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) and the assessor's CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree on high availability impact with no confidentiality or integrity impact, and no public exploit code has been identified at time of analysis.
Code injection in Tinypool versions prior to 2.1.2 allows an attacker who first pollutes Object.prototype to load attacker-controlled JavaScript modules via the worker pool, potentially reading or modifying task data with host process privileges. The flaw is exploitable only when an application calls pool.run(task, options) with its own options object; calls that omit the options argument use a trusted default and are unaffected. No public exploit code or active exploitation has been identified, and the attack requires a pre-existing prototype-pollution vulnerability in the host application, making real-world exploitation condition-gated.
Prototype pollution in the Tinypool npm package prior to 2.1.1 escalates to code execution: an unauthenticated remote attacker who can first pollute Object.prototype.execArgv or Object.prototype.env.NODE_OPTIONS (via a separate prototype-pollution flaw in the host application) has those inherited values copied into ThreadPool.options and forwarded to worker_threads.Worker, so every newly spawned worker loads attacker-supplied JavaScript through --import/--require preload arguments or NODE_OPTIONS. The payload executes with the host process's privileges, potentially exposing CI secrets, signing material, or build artifacts. The vendor assigns a CVSS 4.0 base score of 9.5 (AT:P - the attack requires an existing pollution primitive), exploitation is not confirmed as actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although the upstream fix commit includes a regression test that demonstrates the execArgv/NODE_OPTIONS technique.
Prototype-pollution gadget in the Piscina Node.js worker-pool library allows an attacker who already controls a separate prototype-pollution primitive in the host application to escalate that primitive into worker-thread code preload and execution: an inherited execArgv value is passed straight to the Node.js Worker constructor, an inherited loadBalancer function runs during task scheduling, and inherited env values reshape worker environments. The flaw affects Piscina releases before 4.9.4 (4.x), before 5.3.2 (5.x), and before 6.0.0-rc.5 (6.x RC); exploitation is unauthenticated from Piscina's perspective and needs no user interaction, but the assessed vector (AV:N/AC:H, CVSS 4.0 AT:P) confirms it is not standalone-exploitable without a pre-existing prototype-pollution bug in the consuming application. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Prototype-pollution gadget in the Axios promise-based HTTP client for Node.js and the browser lets a separate, pre-existing prototype-pollution flaw in the same JavaScript process steer how ToFormData serializes outgoing request bodies in Axios 0.28.0 through 0.33.x and 1.15.1 through 1.19.x. Inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values planted on Object.prototype silently rename or reinterpret serialized fields, or make requests fail outright via a polluted maxDepth; a polluted visitor only executes when the attacker already possesses a stronger function-injection primitive, so Axios adds no new code-execution capability on its own. Remote unauthenticated exploitation is inert without that chained second bug, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status; vendor-released patches ship in 0.34.0 and 1.20.0.
Converting an attacker-supplied .docx file with mammoth.js before 1.12.2 allows unauthenticated remote attackers to inject arbitrary properties into Object.prototype via the document's style definitions (CWE-1321 prototype pollution). In versions 1.11.0 through 1.12.1 the pollution can additionally be leveraged to read local server files and disclose them to the document supplier, but only where the application converts further documents in the same long-lived Node.js process and returns the converted HTML back to that party. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch: 1.12.2.
Prototype pollution in the deepmerge JavaScript library (all versions through 4.3.1) allows an attacker who controls a source object passed into a merge operation to inject properties such as '__proto__', 'constructor', or 'prototype' into the resulting object's prototype chain. The impact is latency-dependent: applications that merge untrusted data (for example, a JSON request body) and then read properties without own-property checks will silently inherit attacker-chosen values, which can corrupt application logic, bypass authorization checks, or influence downstream behaviour. The flaw is a library primitive rather than a standalone exploit, and no public exploit code was identified at time of analysis; the vendor CVSS 4.0 score of 8.7 reflects integrity impact only (VC:N/VA:N), and an independent assessment rates it considerably lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) because exploitation requires the consuming application to both pass attacker-controlled source objects and perform unchecked inherited-property reads.
Prototype pollution in Builder.io Gen2 SDKs at versions ≤5.2.11 (React, Vue, Svelte, Solid) and ≤0.25.13 (Qwik, Angular, React Next.js) lets an attacker who can supply a malicious content block - for example an authenticated content editor or author with write access to a Builder.io space - inject binding keys containing __proto__, prototype, or constructor paths that the deep-set helper processes during block rendering without validation. The result is pollution of Object.prototype with high integrity impact (VI:H) and limited confidentiality/availability impact (C:L/A:L): every object created later in the same process inherits the tainted properties, so in multi-tenant or shared SSR/rendering deployments one tenant's crafted content can contaminate other tenants' renders. Exploitation requires a low-privileged position (PR:L, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), and single-tenant sites that render only trusted first-party content have substantially reduced practical exposure; no public exploit identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but conditional risk rather than a top-tier emergency.
Prototype pollution in the yayson npm JSON:API library (<= 4.2.0) lets a remote attacker corrupt Object.prototype by submitting a document whose resource type is "__proto__". Store/LegacyStore use the attacker-supplied type, id, and relationship names as plain-object keys in internal lookup tables, so a crafted JSON:API payload writes attacker-controlled key/value pairs onto every object in the Node.js process for its lifetime. Proof-of-concept code is published in the GitHub Security Advisory; there is no evidence of active exploitation. The guaranteed impact is process-wide denial of service and logic corruption, with escalation to authorization bypass or RCE dependent on gadgets in the consuming application.
Prototype pollution in isomorphic-git before 1.42.0 allows an operator of a malicious Git server to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation, enabling credential theft when the victim's onAuth callback is triggered. The getRemoteInfo function fails to sanitize ref path components before using them as property keys on JavaScript objects, so a ref such as '__proto__/corsProxy' causes all subsequent network operations within the affected isomorphic-git instance to route through an attacker-controlled proxy. No public exploit or CISA KEV listing has been identified at time of analysis; the fix is confirmed in v1.42.0 released 2026-09-10.
Remote code execution in sift.js 17.1.3 arises because the library enumerates query keys with for...in, which traverses the prototype chain, and dispatches the $where operator by compiling its string value via new Function whenever CSP_ENABLED is unset (the default). An attacker who can either supply an untrusted query object containing a string $where, or who has established a prototype-pollution primitive elsewhere in the process (setting Object.prototype.$where), achieves arbitrary JavaScript execution - in the pollution case even benign calls like sift({}) trigger it. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory documents the mechanism in detail.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. Depending on the downstream dependency tree, exploitable outcomes range from reliable denial of service to remote code execution via prototype-pollution gadget chains; no public exploit or active exploitation is confirmed at time of analysis.
Prototype pollution in exceljs-hardened before 5.0.0 lets a remote attacker corrupt Object.prototype by feeding parsed JSON containing a malicious __proto__ property into a cell note, because the deepMerge helper in the note-serialization path fails to reject __proto__, constructor, or prototype keys. Any application that uses this library to process untrusted spreadsheet or note data is affected, and polluting the global prototype can cascade into denial of service, logic tampering, or code execution via downstream gadgets. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote code execution in OpenSearch Dashboards 3.0.0-3.7.x allows an authenticated low-privileged user to fully compromise the server via a prototype pollution flaw in the Time Series Visual Builder (TSVB) plugin. By sending a crafted JSON payload to the metrics visualization API endpoint, an attacker can corrupt the Node.js object prototype chain and achieve arbitrary server-side code execution. Vendor-released patch is available at version 3.8.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Prototype pollution in the gettext-converter npm library's js2i18next() function enables an attacker who can supply crafted translation data to write arbitrary values onto Object.prototype, corrupting the shared prototype chain for the entire Node.js runtime. All versions of gettext-converter below 1.3.3 are vulnerable when the consuming application passes PO or i18next JS translation objects from an untrusted or user-controlled source to the function. Impact ranges from denial of service through malformed object behavior to potential downstream logic bypasses, depending on how polluted properties interact with application code. No public exploit is identified at time of analysis and no CISA KEV listing exists; vendor-released patch is confirmed at version 1.3.3.
Persistent XSS in Zabbix Maps is triggered by prototype pollution in the searchParamsToObject() function, which processes URL query parameters without filtering reserved JavaScript properties such as __proto__. An authenticated low-privilege attacker can craft a malicious URL that pollutes Object.prototype; when a victim user views the Maps page, jQuery's unsafe DOM element creation traverses the poisoned prototype chain and executes the attacker-controlled payload in the victim's browser session. No public exploit code and no CISA KEV entry have been identified at time of analysis, but the vulnerability class is well-understood and reproducible by intermediate-level attackers.
Prototype pollution in ApostropheCMS 4.32.0 and earlier enables an authenticated editor to trigger a persistent, process-wide denial of service via a single PATCH REST API request. By sending `{ "toString.call": "x" }` to `PATCH /api/v1/article/:id`, the attacker walks the JavaScript prototype chain through `apos.util.set()` into the shared `Object.prototype.toString` function object and shadows its `call` method, breaking every subsequent `Object.prototype.toString.call()` invocation in Node.js - including those inside the MongoDB driver - until the server process is manually restarted. No separate proof-of-concept repository has been published, but the exact attack payload is fully disclosed in the public GitHub security advisory GHSA-vmg4-6gfg-83qx and the upstream commit diff, and active exploitation has not been confirmed by CISA KEV.
Prototype pollution in Trigger.dev's run metadata API (versions 3.3.8 through 4.5.5) lets any authenticated tenant corrupt the shared Node.js webapp process's Object.prototype by supplying crafted path keys to the PUT /api/v1/runs/:runId/metadata endpoint. The root cause is the unsanitized use of attacker-supplied operation.key values passed directly to JSONHeroPath.set() in packages/core/src/v3/runMetadata/operations.ts without filtering __proto__, constructor, or prototype segments. A single exploiting tenant can corrupt Prisma ORM queries, poison Prometheus metric labels, break other tenants' worker authentication, and cause a process-wide denial of service - making this a multi-tenant isolation failure with scope-changed impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Prototype pollution in n8n's Edit Fields (Set) node allows any authenticated user with workflow execution permissions to corrupt a shared global in the main Node.js process, triggering an instance-wide denial of service that locks out all users until a manual process restart. Affected are all n8n releases before 1.123.67, 2.31.5, and 2.32.1 across the 1.x and 2.x branches. The attack requires only a low-privilege authenticated account and no special configuration, making this a high operational priority for any multi-user or shared n8n deployment; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Prototype pollution in @phun-ky/defaults-deep prior to version 2.0.5 allows remote unauthenticated attackers to write arbitrary properties to Object.prototype by supplying crafted objects containing keys such as __proto__, constructor, or prototype to the defaultsDeep() function. The root cause is that the library performed recursive object merging without filtering these special property names, enabling full process-wide prototype chain manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and exploitation is straightforward wherever untrusted input reaches the affected function.
Prototype pollution in the @instana/core Node.js tracer, part of IBM Observability with Instana Agent builds 1.0.303 to 1.0.320, allows a local attacker to inject arbitrary properties into JavaScript object prototypes. This can lead to information disclosure and high integrity impact. No public exploit or active exploitation reported; vendor patch is available.
Remote denial of service in find-my-way (the HTTP router underneath Fastify) affects all versions up to and including 9.6.0 when the router serves requests from a Node.js HTTP/2 server. Because the internal method-to-tree map is a plain JavaScript object, an unauthenticated attacker can send a request whose HTTP method is an inherited Object property name such as constructor, toString, or __proto__, causing find() to treat a prototype value as a router node and crash the process on currentNode.prefix.length. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trigger is trivial and a fixed release (9.7.0) is available.
Privilege escalation via prototype pollution in n8n workflow automation lets an authenticated low-privilege user (holding the default workflow:create permission) corrupt Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. Once polluted, subsequent unauthenticated requests are evaluated as a privileged user, exposing internal user and project listing endpoints. This is an information-disclosure and access-control flaw with no public exploit identified at time of analysis; CVSS 4.0 base score is 7.1.
AdonisJS Bodyparser versions 10.1.3-10.1.4 and 11.0.0-next.9-11.0.2 are
Prototype pollution in JetBrains YouTrack's websandbox bridge (all versions before 2026.2.16593) lets an attacker who can reach the sandbox boundary corrupt JavaScript Object.prototype, potentially escaping the sandbox or disclosing information. The flaw was internally reported by JetBrains and classed as CWE-1321; it carries a vendor-published CVSS of 9.8, but no public exploit has been identified at time of analysis and EPSS rates exploitation probability low at 0.40% (32nd percentile).
Prototype pollution in Style Dictionary's `convertTokenData()` utility function allows an attacker who can supply token data with a `__proto__`-keyed entry to corrupt `Object.prototype` globally, affecting all downstream object operations in the same runtime. All deployments using versions 4.3.0 through 5.4.3 on npm are affected, with severity scaling sharply by context: Node.js server applications ingesting untrusted token data face high-impact exploitation, while build-time-only pipelines with controlled token sources face low residual risk. A publicly available proof-of-concept exists (GitHub Gist), though SSVC signals exploitation activity as none at time of analysis.
Prototype pollution in the npm package scim-patch (versions <= 0.9.0) allows authenticated SCIM provisioning clients to mutate Object.prototype process-wide by submitting a PATCH operation whose value object contains a key such as `__proto__.someProp` or `constructor.prototype.someProp`. Because the side effect persists for the lifetime of the Node process and leaks into every plain object, downstream code that checks flags like `req.user.isAdmin` against unpolluted plain objects can suffer privilege escalation, logic bypass, or denial of service. Publicly available exploit code exists (proof-of-concept in the GHSA advisory and now in the package's test suite); no public exploit identified as in-the-wild use at time of analysis.
Prototype pollution in deepstream.io versions prior to 10.0.5 allows an authenticated client with write permission to any record to corrupt the Node.js Object prototype by submitting record-update messages whose path contains tokens such as __proto__, constructor, or prototype. Because deepstream's permission valve and record-transition pipeline both invoke setValue with the attacker-controlled path, polluting the prototype can taint subsequent permission and transition logic and lead to privilege escalation across all connected clients. No public exploit identified at time of analysis, though the upstream commit (54b8e29) and patch tests publicly demonstrate the exact vulnerable path semantics.
Sandbox escape via prototype pollution in ThingsBoard (versions prior to v4.3.1.2) allows a TENANT_ADMIN-authenticated user to achieve arbitrary code execution within the tb-js-executor sandboxed JavaScript context. The flaw lets a rule-chain script reach the host realm through the `args.constructor.constructor` chain (e.g., synthesizing a Function that returns `process`), defeating the intended VM isolation. No public exploit identified at time of analysis, though the upstream regression test in PR #15600 effectively documents the escape technique.
Denial of service in n8n workflow automation platform (versions prior to 2.24.0) allows an authenticated user with workflow create/edit permissions to trigger global prototype pollution via a crafted table parameter in the Microsoft SQL node. The pollution of Object.prototype persists for the lifetime of the n8n process, causing application-wide validation failures until the server is restarted. No public exploit identified at time of analysis, though the vendor advisory provides clear technical detail.
Remote prototype pollution in i18next-http-middleware before 3.9.7 allows unauthenticated attackers to write to Object.prototype by submitting dotted request-body keys such as '__proto__.polluted' to the missingKeyHandler. The 3.9.3 denylist blocked only literal unsafe keys; downstream backends (notably i18next-fs-backend ≤ 2.6.5) that split missing-key strings on the configured keySeparator then walked these segments into an unguarded setPath(). No public exploit identified at time of analysis, but PoC payloads are embedded in the upstream security test suite.
Prototype pollution in i18next-fs-backend versions prior to 2.6.6 allows remote attackers to write arbitrary properties onto Object.prototype by submitting crafted missing-translation keys such as '__proto__.polluted' to applications that expose i18next-http-middleware's missingKeyHandler to untrusted input. Backend.writeFile() split keys on the configured keySeparator (default '.') and the getLastOfPath walker in lib/utils.js did not filter unsafe segments before traversing the target object. No public exploit identified at time of analysis, but a coordinated-disclosure advisory (GHSA-2933-q333-qg83) and a fixing commit are public, and downstream impact can include denial of service, configuration poisoning, and bypass of property-based security checks.
Prototype pollution in ApostropheCMS versions up to and including 4.30.0 allows an authenticated editor to poison Object.prototype via the $pullAll patch operator, ultimately bypassing authorization on all piece-type REST API endpoints for unauthenticated requests until the Node.js process restarts. The flaw stems from apos.util.set() failing to sanitize __proto__ in dot-notation paths, and no public exploit identified at time of analysis but the advisory describes a confirmed exploitation gadget in publicApiCheck(). No vendor-released patch identified at time of analysis, making this an open-window risk for any internet-exposed editor account.
Denial-of-service and HTTP header injection in the axios npm package (>=1.0.0,<1.16.0 and <=0.31.1) arise from two read-side prototype-pollution gadgets in lib/utils.js merge() and lib/core/mergeConfig.js, allowing a polluted Object.prototype (typically from an upstream dependency such as lodash CVE-2018-16487) to inject arbitrary outbound headers or crash every axios call with a synchronous TypeError. Publicly available exploit code exists in the GHSA advisory PoC, but EPSS is only 0.04% (13th percentile) and SSVC marks Automatable=no with partial technical impact, so this is a credible secondary-gadget risk rather than a mass-exploitation target.
Prototype pollution in the @nevware21/ts-utils npm library (versions <= 0.13.0) lets an attacker who can influence an object passed to objDeepCopy() or objCopyProps() inject a __proto__ (or constructor/prototype) key that overwrites Object.prototype for the entire application. The flaw stems from _copyProps() in lib/src/object/copy.ts iterating with for...in and no hasOwnProperty guard, so parsing untrusted JSON and deep-copying it is enough to poison every object. A working proof-of-concept is published in the GHSA advisory, though EPSS is very low (0.06%) and the issue is not on CISA KEV, so publicly available exploit code exists but no active exploitation is confirmed.
Cookie-attribute injection in js-cookie versions 3.0.5 and earlier allows remote attackers to override security-relevant Set-Cookie attributes (domain, secure, samesite, expires, path) by supplying a JSON-derived attributes object containing a __proto__ key. Publicly available exploit code exists in the GHSA-qjx8-664m-686j advisory demonstrating per-instance prototype hijack via the assign() helper. No active exploitation has been observed, and the issue is fixed in 3.0.7.
Prototype pollution in the @tmlmobilidade/utils npm package allows remote unauthenticated attackers to inject properties into Object.prototype via the setValueAtPath() helper, leading to integrity compromise and partial availability impact in any downstream application that passes user-influenced paths into the function. The flaw is rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N) and is fixed in version 20260509.0340.15; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Prototype pollution in the npm package parse-nested-form-data version 1.0.0 and earlier allows unauthenticated remote clients to mutate Object.prototype of the running Node.js process by submitting a FormData field whose name contains __proto__ in bracket or dot notation. The flaw resides in handlePathPart in src/index.ts, which walks nested path segments without filtering reserved keys, so a single crafted field name pollutes the prototype chain of every plain object in the process. No public exploit identified at time of analysis, but a working proof-of-concept is published in the GHSA advisory itself.
Prototype pollution in the npm package form-data-objectizer (<= 1.0.0) lets unauthenticated remote attackers mutate Object.prototype by submitting a single HTTP form field whose name uses bracket notation such as __proto__[polluted] or constructor[prototype][polluted]. The defect lives in treatInitial/treatSecond inside index.cjs, where an 'in' check walks the prototype chain and lets the parser write to inherited properties. CVSS is 8.2 (High) with Integrity:High; publicly available exploit code exists (working PoC published in the GHSA advisory), but there is no public exploit identified as being used in attacks and no CISA KEV listing.
Prototype pollution in the jsondiffpatch JavaScript library before 0.7.6 allows attackers to modify Object.prototype by supplying crafted delta documents to jsondiffpatch.patch() or JSON Patch documents to the jsonpatch formatter's patch() API. Because attacker-controlled key names and JSON Pointer path segments were used to traverse and mutate objects without filtering __proto__, constructor, or prototype, any application that feeds untrusted diffs into the library can have global object behavior tampered with. A public POC exists in the Snyk advisory and an accompanying gist, but there is no public exploit identified at time of analysis (not on CISA KEV).
Prototype pollution in @ranfdev/deepobj npm package (versions ≤1.0.2) allows remote unauthenticated attackers to modify JavaScript object prototypes when property paths containing '__proto__', 'constructor', or 'prototype' are processed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation against network-accessible applications, though real-world impact depends critically on whether user-controlled input is passed to property path parameters. EPSS data unavailable; not listed in CISA KEV. Publicly available exploit code exists (GitHub advisory GHSA-x7q7-fchv-8h2j). Vendor-released patch available in version 1.0.3.
Remote code execution in n8n workflow automation platform is possible via a prototype pollution patch bypass in the XML node, affecting versions prior to 1.123.43, 2.20.7, and 2.22.1. Authenticated users with workflow creation or modification permissions can bypass the prior fix for GHSA-hqr4-h3xv-9m3r and, by chaining the XML node with other nodes, achieve code execution on the n8n host. No public exploit identified at time of analysis, though EPSS is low (0.05%) suggesting limited near-term mass exploitation despite the high CVSS 4.0 score of 9.4.
Prototype pollution leading to remote code execution in n8n workflow automation platform allows authenticated users with workflow create/modify permissions to corrupt the global Object prototype via an unvalidated pagination parameter in the HTTP Request node. Affecting n8n versions before 1.123.43, 2.20.7, and 2.22.1, the flaw chains with other techniques to escalate to full instance compromise. No public exploit identified at time of analysis, with EPSS at 0.05% (16th percentile) indicating low observed exploitation interest despite CVSS 4.0 9.4 critical rating.
Prototype pollution in protobufjs allows denial of service through corrupted JavaScript built-ins when parsing untrusted schemas. Attackers who control protobuf schemas or JSON descriptors can write to inherited object properties on global constructors, causing process-wide state corruption that persists until restart. CVSS 7.5 (High) with network vector and no authentication required, but real-world risk is limited to applications parsing schemas from untrusted sources-applications only decoding untrusted message payloads with trusted schemas are not affected. Vendor-released patches available: v7.5.6 and v8.0.2. No active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis.
Prototype pollution in @rvf/set-get allows remote attackers to modify Object.prototype on Node.js servers processing form data via Remix or React Router applications. The setPath function fails to block dangerous property keys (__proto__, constructor, prototype) when flattening form submissions, enabling unauthenticated attackers to inject arbitrary properties into all JavaScript objects across the server process with a single malformed HTTP request. Working proof-of-concept code is publicly available demonstrating property injection via field names like '__proto__[polluted]'. The vulnerability affects default configurations with no special setup required - any endpoint using parseFormData or createValidator is exploitable. CVSS 8.2 High severity driven by network attack vector (AV:N), low complexity (AC:L), and no authentication requirement (PR:N), with high integrity impact from the ability to alter application logic process-wide.
Prototype pollution in the velocityjs npm package (Velocity.js <= 2.1.5) lets an attacker who controls template content poison Object.prototype through the #set directive, enabling denial of service and, depending on server-side gadgets, remote code execution. The flaw stems from unvalidated path-key assignment in /src/compile/set.ts, which writes attacker-supplied keys directly onto the target object. Publicly available exploit code exists (a working PoC is published in the GHSA advisory); there is no evidence of active exploitation, and the EPSS score is very low at 0.08% (23rd percentile).
Prototype pollution read-side gadgets in the axios HTTP adapter (npm, versions >=1.0.0 to <1.15.2) allow an attacker who has already polluted Object.prototype in the same Node.js process to hijack every outbound request - injecting attacker-controlled Authorization headers, redirecting relative-URL requests to an external server, pointing requests at internal Unix sockets (SSRF/container escape), forcing Node's insecure HTTP parser, and even executing an attacker-supplied beforeRedirect callback. The flaw stems from five config properties (auth, baseURL, socketPath, beforeRedirect, insecureHTTPParser) being read via direct property access that traverses the prototype chain, unlike eight sibling properties already guarded by an own() helper. A working proof-of-concept is published in the GHSA advisory, but EPSS is only 0.03% and the issue is not in CISA KEV - no public exploit identified at time of analysis as a standalone attack, and it requires a separate prototype pollution primitive to fire.
Prototype pollution in n8n's XML node allows authenticated workflow editors to achieve remote code execution through global prototype manipulation. The vulnerability affects n8n workflow automation platform versions prior to 1.123.32, 2.17.4, and 2.18.1, enabling attackers with workflow creation privileges to inject malicious properties into JavaScript object prototypes that can be exploited by other nodes to execute arbitrary code. Vendor-released patches are available for all affected version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS 10.0 score reflects the critical scope change and complete system compromise potential.
Prototype pollution in n8n's XML webhook parser (xml2js library) enables remote code execution when chained with Git node SSH operations. Authenticated users with workflow editing permissions can inject malicious XML payloads to pollute JavaScript object prototypes, then leverage the polluted prototype in Git node operations to execute arbitrary code on the n8n host server. GitHub advisory GHSA-q5f4-99jv-pgg5 confirms patches available in versions 1.123.32, 2.17.4, and 2.18.1. No CISA KEV listing or public POC identified at time of analysis, but the CVSS 10.0 score appears inconsistent with the authenticated (PR:L expected) nature described in the advisory.
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification of all JSON responses or complete HTTP transport hijacking when the JavaScript Object.prototype has been polluted by a co-dependency. This vulnerability requires a separate prototype pollution source within the same Node.js process but requires no authentication once that precondition exists. An attacker can then access credentials, headers, and request bodies across the application. EPSS data not available; no public exploit identified at time of analysis.
Prototype pollution in Adobe Acrobat Reader allows arbitrary code execution when victims open malicious PDF files. Affects Acrobat Reader versions through 26.001.21411, 24.001.30360, and 24.001.30362. Attack requires local file access with user interaction (CVSS AV:L/UI:R) but achieves scope change and full CIA impact (S:C/C:H/I:H/A:H), yielding CVSS 8.6. No public exploit identified at time of analysis. Vendor advisory available from Adobe (APSB26-44). EPSS data not provided; exploitation status limited to user-interaction-dependent local attack vector.
Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execution in user context via malicious PDF files. Attack requires user interaction to open a crafted document. CVSS 9.6 (Critical) reflects network-deliverable code execution with scope change, though EPSS 0.24% (46th percentile) suggests moderate real-world exploitation probability. No public exploit identified at time of analysis.
Prototype pollution in the LangSmith JavaScript/TypeScript SDK (npm 'langsmith', versions <= 0.5.17) lets an attacker who controls object keys passed to the createAnonymizer() API pollute Object.prototype for the entire Node.js process. The internally vendored lodash set() utility guards only the __proto__ key and misses the constructor.prototype traversal path, so a crafted key like 'constructor.prototype.polluted' bypasses the fix. Publicly available exploit code exists (SSVC 'poc' plus regression tests in the fix PR), but EPSS is only 0.04% with no evidence of active exploitation; notably the vendor GHSA rates this Medium (~CVSS 5.6), conflicting sharply with the NVD 9.8.
Prototype pollution in defu npm package (≤6.1.4) allows remote attackers to override application logic by injecting __proto__ keys through unsanitized user input. The vulnerability enables authentication bypass and arbitrary property injection when applications merge untrusted JSON, database records, or configuration data using defu(). CVSS 7.5 (High) with network-accessible, low-complexity exploitation requiring no authentication. No active exploitation confirmed (not in CISA KEV), but public proof-of-concept exists in the GitHub advisory demonstrating admin privilege escalation.
Prototype pollution in MikroORM's Utils.merge function allows attackers to modify JavaScript object prototypes when applications pass untrusted user input into ORM operations. Affects @mikro-orm/core npm package, enabling denial of service and potentially SQL injection when polluted properties influence query construction. No public exploit identified at time of analysis, though GitHub security advisory published by the project maintainers confirms the vulnerability class (CWE-1321).
Prototype pollution in convict npm package version 6.2.4 allows attackers to bypass previous security fixes and pollute Object.prototype through crafted input that manipulates String.prototype.startsWith. The vulnerability affects applications processing untrusted input via convict.set() and can lead to authentication bypass, denial of service, or remote code execution if polluted properties reach dangerous sinks like eval or child_process. A working proof-of-concept exploit demonstrating the bypass technique exists in the advisory.
Prototype pollution in Mozilla's node-convict configuration library allows attackers to inject properties into Object.prototype via two unguarded code paths: config.load()/loadFile() methods that fail to filter forbidden keys during recursive merge operations, and schema initialization accepting constructor.prototype.* keys during default-value propagation. Applications using node-convict (pkg:npm/convict) that process untrusted configuration data face impacts ranging from authentication bypass to remote code execution depending on how polluted properties propagate through the application. This represents an incomplete fix for prior prototype pollution issues (GHSA-44fc-8fm5-q62h), with no public exploit identified at time of analysis.
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to achieve remote code execution. Versions prior to 2.14.1, 2.13.3, and 1.123.27 are affected. The CVSS score of 9.4 (Critical) reflects network-based exploitation with low complexity requiring only low-level authentication, though no current KEV listing or public POC availability is indicated in the provided intelligence.
Prototype pollution in the flatted npm library (versions <= 3.4.1) lets an attacker who controls input to the parse() function leak a live reference to Array.prototype into the returned object, so any later write to that property poisons the global prototype chain. The flaw stems from parse() using attacker-supplied JSON string values such as "__proto__" as raw array index keys without numeric validation. Publicly available exploit code exists (a three-line proof of concept in the GitHub Security Advisory), though EPSS is only 0.01% (2nd percentile) and it is not in CISA KEV.
Parse Server is vulnerable to denial of service when remote attackers craft malicious cloud function names that exploit prototype chain traversal, allowing them to trigger stack overflows and crash the server process. The vulnerability stems from improper property lookup restrictions during function name resolution. A patch is available that limits lookups to own properties only.
Prototype pollution in Apollo Federation before multiple versions.
In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.
Immutable.js provides many Persistent Immutable data structures. versions up to 3.8.3 is affected by improperly controlled modification of object prototype attributes (prototype pollution).
AdonisJS is a TypeScript-first web framework. versions up to 10.1.3 is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 7.2).
Prototype pollution in the Locutus JavaScript library (npm package, versions >= 2.0.12 and < 2.0.39) lets attacker-influenced input passed to the php.strings.parse_str function pollute Object.prototype, bypassing a prior guard. The earlier fix rejected forbidden keys using String.prototype.includes(), but an attacker able to override that method - or supply crafted keys such as constructor[prototype][polluted]=yes - defeats the check; publicly available exploit code exists in the GHSA advisory. EPSS exploitation probability is very low (0.01%, 1st percentile), it is not on CISA KEV, and no public exploit is identified as active in the wild.
Denial of service in the @casl/ability npm package (6.7.5 through 7.0.1) stems from prototype pollution in the rulesToFields() helper, which expands attacker-influenced dotted condition keys through an internal setByPath utility and can overwrite inherited builtins such as Function.prototype.call, corrupting shared objects process-wide and crashing the Node.js process. Only applications that call rulesToFields() on rule conditions whose keys are under an attacker's write influence are affected, and the required access is authenticated (PR:L) with high attack complexity, so exposure is conditional rather than broad. The impact is availability only (no confidentiality or integrity loss), no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, making this a moderate-severity issue rather than an urgent one.
Prototype pollution in Progress Kendo UI for jQuery versions prior to 2026.3.1015 lets an authenticated, low-privileged attacker who can supply data accepted by a model's Model.accept method - such as a crafted server response or record - inject unsafe keys like __proto__, constructor, or prototype into object prototypes, altering application behavior and potentially compromising the confidentiality and integrity of application data. The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires some privilege level and user interaction and that real impact is gated on how the application consumes the polluted objects, with server-side JavaScript (Node) scenarios most exposed. The vendor has released a fix in version 2026.3.1015; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Prototype pollution in the n8n AI workflow builder allows an authenticated user to degrade an instance until it is restarted by creating a workflow node whose name is a reserved key such as '__proto__' and then invoking the connect-nodes operation, which merges node connections using node names as object members without filtering reserved keys. Affected releases are all versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1; the impact is availability-only (CVSS 6.0, C:N/I:N/A:H in the vendor's CVSS 4.0 vector; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity loss and no public exploit identified at time of analysis. Exploitation requires a valid account with the ability to create workflow nodes through the API and access to the AI workflow builder's connect-nodes operation, and it further depends on the attacker supplying the specific crafted node name, which is why the vendor's vector carries an AT:P attack-requirements value.
Prototype pollution in the msgpack5 npm package (all versions prior to 6.1.0) allows attacker-controlled MessagePack input to replace the prototype of a decoded object when the application constructs its msgpack5 instance with an empty or partial options object - a usage pattern that silently drops the default protoAction:'error' guard. A decoded map containing a __proto__ key can then alter inherited properties on that decoded object and influence downstream behavior, although Object.prototype is never modified globally. This is an unauthenticated, network-reachable issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) with moderate severity; the independent assessment rates impact as Integrity Low / Availability Low, and no public exploit code has been identified at time of analysis.
Prototype pollution in the npm package traverse (versions 0.3.6-0.3.9, 0.4.0-0.4.6, 0.5.0-0.5.2, and 0.6.0-0.6.11) lets unauthenticated remote attackers add or overwrite properties on String.prototype, Number.prototype, or Boolean.prototype when an application passes an attacker-controlled path array to set(), as when a path is built directly from an untrusted JSON body. Exploitation is gated entirely on that anti-pattern: the path must cross or end on a primitive value, and plain JSON data is not sufficient to reach the far higher-impact Object.prototype, which requires a non-data path segment such as an object whose toString returns a different value on each call or a Proxy that accepts an assignment without storing it. Impact is limited to low integrity and low availability with no confidentiality effect (vendor CVSS 4.0 score 6.9 Medium; independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no public exploit identified at time of analysis and confirmed fixes available from the vendor in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Prototype-chain manipulation in the oRPC @orpc/json-schema SmartCoercionPlugin (versions prior to 1.14.9) lets a remote, unauthenticated client inject `__proto__` or Object.prototype member names such as `constructor` and `toString` into a request body handled by any procedure that declares an object input schema. Abused successfully, this can steer the single coerced request object so attacker-controlled inherited values are treated as sub-schemas and satisfy the coercer's check, potentially influencing handler logic, Object.assign calls, or configuration lookups, with a secondary information-disclosure angle noted in vendor metadata. Impact is strictly bounded - the global Object.prototype, concurrent requests, other users, and unrelated objects are not modified, legitimate own-property `__proto__` fields are dropped, and downstream schema validation still runs - and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.
Prototype pollution in the JavaScript bindings of Apache Thrift (all versions before 0.25.0) allows unauthenticated remote attackers to corrupt object prototype attributes when an application deserializes attacker-influenced Thrift messages through generated JS code. Impact is integrity-only and limited - the vendor-assigned CVSS 4.0 base score is 6.3, while our independent CVSS 3.1 assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, reflecting that exploitation requires the JS binding to be in the data path and specific object properties to be reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Apache has released a fix in version 0.25.0, which also requires regenerating JS code to be effective.
Prototype replacement in stream-json before 3.6.0 lets a JSON key literally named __proto__ overwrite the prototype of an assembled object, because Assembler and FlexAssembler wrote properties with plain assignment and thereby invoked the inherited setter instead of creating an own data property. Applications that read authorization, feature-flag, or control-flow values through prototype inheritance from a parsed object - or that call Object.prototype methods on it - can consume attacker-controlled inherited properties or hit runtime errors when the prototype is null; the global Object.prototype is never polluted, so impact is confined to the individual parsed object (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, low integrity and availability impact only). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is genuine and its real-world exposure hinges on a disputed threat model: the maintainer documents intended input as locally owned dumps, exports, and logs (AV:L) while the reporter treats untrusted JSON parsing as part of the library contract, and no authentication or user interaction is required once hostile JSON reaches the parser (PR:N/UI:N).
Prototype-pollution-assisted cross-site scripting in the KaTeX math-rendering JavaScript library (versions 0.11.0 through 0.18.2) lets attacker-controlled expressions end up in trusted-rendering mode when an inherited `trust` property is picked up from a polluted prototype, producing clickable `javascript:` links or attacker-chosen external resources in any consuming page that inserts unsanitized KaTeX output. This is not a standalone remote exploit: KaTeX does not create the prototype pollution itself, so a separate pollution primitive (or attacker control over the options object's prototype) must already exist in the host application, rendering an expression alone never executes script, and script execution requires the victim to actively click a crafted link. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the CVSS 4.0 base score is only 2.1 (our independent 3.1 assessment is AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting the compounding prerequisites rather than a broadly reachable XSS bug.
Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write arbitrary properties onto JavaScript's Object.prototype whenever a Vaadin application merges an object it does not control into a chart configuration (e.g. updateConfiguration or a chart series config) or into a component's i18n property. Once injected, those properties are visible to every object in the running client-side application, degrading UI integrity and availability rather than exposing data or yielding direct code execution. Exploitation is conditional - the host application must actually route crafted input containing a __proto__ (or equivalent prototype) key into one of those two merge sinks - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV). Affected ranges are Vaadin 23.0.0-23.6.13, 24.0.0-24.9.20, 24.10.0-24.10.9, 25.0.0-25.1.11 and 25.2.0-25.2.6 across the Maven artifacts and the corresponding @vaadin/charts and @vaadin/component-base npm packages.
Header sanitization bypass in the Axios fetch adapter (npm axios 1.7.0 through 1.19.x) allows attacker-controlled request headers - such as Authorization, caching directives, or metadata-service targeting values - to be applied after Axios has already built a sanitized Request object, enabling scope-changed integrity impact (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N). Exploitation is not standalone: it is a gadget that requires a separate same-process prototype-pollution flaw capable of writing Object.prototype.headers, plus use of the fetch-based transport rather than the default Node HTTP adapter. No public exploit code is identified at time of analysis, but the fix and code change are public in the Axios v1.20.0 release, pull request #11141, and commit d19040bd, so the affected range should be treated as patch-now.
Axios versions 0.27.2 through below 0.34.0, and 1.0.0 through below 1.20.0, can silently upgrade an intended GET into a state-changing HTTP method when a request is sent through the default instance without an explicit method. The flaw is a read-side gadget, not a pollution source: calls such as axios({ url }) or axios.request({ url }) omit a method, so dispatch looks up the method on the prototype chain and honours an Object.prototype.method value planted by an unrelated prototype-pollution vulnerability in the same process. Because a separate pollution primitive must already exist, this is only exploitable as part of a chain, which is why the vendor CVSS 4.0 vector carries AT:P; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vendor scores it 6.9 (AV:N/AC:L/AT:P/PR:N/UI:N, SI:H only), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, treating the unauthenticated network-reachable integrity impact as high but gated on the pollution prerequisite.
Prototype pollution in React Native Worklets versions before 0.12.2 allows unauthenticated remote attackers to trigger a denial of service by supplying a crafted object with a __proto__ property through the Worklets serialization path, causing the React Native application to crash. The flaw exists in clonePlainJSObject and the native SerializableObject serialization, where the __proto__ key modifies the prototype of a cloned object instead of being treated as an own property. No public exploit code or confirmed active exploitation has been identified, but if the malformed data is persisted, the denial of service can persist across application restarts.
Prototype pollution in the unflatten helper of Builder.io Gen2 SDKs (the @builder.io/sdk-react, sdk-vue, sdk-svelte and sdk-solid packages at or below 5.2.11, and sdk-angular, sdk-react-nextjs and sdk-qwik at or below 0.25.13) lets unauthenticated remote attackers poison Object.prototype in a victim's browser by luring the victim into opening a crafted preview link whose builder.userAttributes query parameters carry __proto__ or prototype segments. Exploitation is not automatable against a passive server - it hinges on user interaction (UI:P), because the SDK must actually be running in the victim's browser when the malicious URL is processed, and real harm (DOM XSS, client-side logic tampering, denial of service) only materializes if downstream application code reads the polluted inherited properties. No CISA KEV entry and no public exploit code were identified at time of analysis, and the independent assessment rates real-world risk as moderate-to-low.
Prototype pollution in node-opcua-client versions prior to 2.145.0 lets an attacker who controls OPC UA event or condition field names corrupt Object.prototype through the internal fieldsToJson helper in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts, which assigns unsanitized field names and permits a __proto__.pollutedKey assignment path. Only host applications that feed attacker-controlled event field names into that serialization helper are exposed; a malicious or compromised OPC UA server (or untrusted publisher) must supply the crafted field name AND the application must omit field-name sanitization, which is why the vendor rates attack complexity as high. There is no public exploit identified at time of analysis and no confirmed remote code execution - impact is bounded to denial of service or application logic corruption with no confidentiality exposure, making this a genuinely low-priority issue despite being a real prototype-pollution flaw. The issue is unauthenticated per the CVSS vector (PR:N) and is fixed in 2.145.0.
Prototype pollution in hapijs/joi's messages compilation function allows network-reachable attackers to replace an object's prototype chain by supplying `__proto__` as an error-code key in custom validation messages. Affected versions are joi before 17.13.8 and before 18.2.9. Applications that pass externally-controlled data (e.g., JSON request bodies) to `.messages()` or `.prefs({ messages: ... })` can have downstream code silently broken when it relies on standard `Object.prototype` methods. No public exploit identified at time of analysis, though the patch commit ships a working proof-of-concept test file.
Prototype pollution in n8n's Instance AI workflow summary feature allows authenticated users to disrupt the main n8n process by submitting crafted workflows via the REST API. The `summarizeWorkflowStructure` function in `packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts` uses workflow node names and connection keys as raw JavaScript object keys without sanitization, so keys such as `__proto__` or `constructor` cause nested writes to reach `Object.prototype` in the main process and corrupt the JavaScript runtime state. This renders the n8n instance unreliable or unavailable for subsequent requests, making it a targeted denial-of-service attack requiring only low-privilege API access. No public exploit and no CISA KEV listing have been identified at time of analysis; patches are available in versions 2.37.7 and 2.38.2.
Prototype pollution in n8n's MCP workflow-validation tool allows an authenticated user holding only a workflow:read grant to escalate privileges and take over owner accounts that are not protected by MFA. The flaw affects n8n versions before 2.41.4 and 2.42.x before 2.42.1, and exploitation requires that the MCP validation feature be enabled and reachable so its interpreter can evaluate caller-supplied code in the main process. No public exploit code was identified at time of analysis, and the attack chain - polluting a shared prototype to replace a built-in method that server-side permission checks rely on - is a genuine privilege-escalation priority for exposed instances rather than an internet-wide emergency, since valid low-privilege authentication, feature availability, and the absence of MFA on the target owner account are all prerequisites.
Privilege escalation leading to remote code execution in Xen Orchestra deployments before 6.9.0 lets any authenticated account, regardless of how few permissions it holds, obtain global administrator rights. The vm.importFromEsxi and vm.importMultipleFromEsxi methods lack access-control checks, so an authenticated remote attacker who can make xo-server import from an attacker-controlled ESXi host serving a crafted .vmx file containing a __proto__.permission property pollutes Object.prototype; every permission-less account then inherits admin rights, and that administrative foothold enables remote code execution. The flaw is rated 7.7 (CVSS 4.0, AV:N/AC:H/PR:L) and assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; exploitation requires a valid low-privileged Xen Orchestra account plus control of the ESXi endpoint xo-server connects to, and no public exploit code was identified at time of analysis.
Unauthorized SCIM API access in Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 arises from a shipped default bearer token that the installer and configuration script fail to rotate, enabling remote, unauthenticated attackers who know the token to perform user and group provisioning operations. Chaining this with CVE-2026-61834 in the scim-patch dependency allows server-side prototype pollution and, under Node.js 24/Express with specific gadget chains, remote code execution. The underlying defect is removed in HAS 2026.1; no public exploit code has been identified at time of analysis.
Prototype pollution in dot-access through 1.0.0 allows remote attackers to modify Object.prototype when a consuming application passes an attacker-influenced dotted path to set(). By injecting __proto__ path segments, attackers can alter authorization flags or option defaults across all objects and may crash the process; the flaw is CWE-1321, rated 8.8 in CVSS 4.0, and assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with high integrity and low availability impact. No public exploit identified at time of analysis and no CISA KEV confirmation; exploitation is integration-specific because the path argument must be attacker-controlled.
Prototype pollution in the npm package @stablelib/cbor (versions before 2.0.4) allows an attacker who supplies a CBOR payload to make decoder output inherit attacker-chosen properties, because a map key named "__proto__" is written via bracket assignment and reaches the JavaScript prototype setter instead of creating a normal data property. Applications that pass untrusted CBOR to decode() and then read properties through normal prototype lookup, or merge the decoded object into configuration, authorization or feature-flag state, can act on inherited attacker values - the upstream GHSA includes a working proof-of-concept, so publicly available exploit code exists, but there is no KEV listing and no confirmed active exploitation. Impact is conditional and integrity-only (no confidentiality or availability loss), and the independently assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N rates it below the vendor-supplied 8.9 CVSS 4.0 score because exploitation depends on that specific downstream consumption pattern.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker submit prototype-sensitive field paths to the plugin's endpoints, corrupting object prototypes and triggering unintended application behavior that can escalate to remote code execution. The flaw affects Payload 3.0.0 through versions before 3.88.0 and 4.0.0-canary.0 through versions before 4.0.0-canary.27, but only when the Import Export plugin is installed and enabled - sites without that plugin are unaffected. No public exploit code has been identified at time of analysis, and exploitation is gated by the presence of a reachable prototype-pollution gadget in the target application, so real-world impact is conditional even though the vendor advisory and a 9.3 CVSS 4.0 score (independent assessment: CVSS 3.1 8.1-range with AC:H) both flag it as high severity.
Prototype pollution in `@graphql-tools/utils` `mergeDeep()` lets a remote, unauthenticated client submit a single aliased GraphQL query that overwrites inherited JavaScript built-ins such as `Function.prototype.call`, causing denial of service against the gateway or schema-stitching service until it is restarted. Only deployments built on @graphql-tools/utils <= 12.0.0 that actually merge objects returned from two subgraphs (the ordinary `@shareable` field or cross-subgraph entity case, e.g. Hive Gateway) invoke the vulnerable code path; single-subgraph servers are not affected. Both CVSS 4.0 (8.2, AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) and the assessor's CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree on high availability impact with no confidentiality or integrity impact, and no public exploit code has been identified at time of analysis.
Code injection in Tinypool versions prior to 2.1.2 allows an attacker who first pollutes Object.prototype to load attacker-controlled JavaScript modules via the worker pool, potentially reading or modifying task data with host process privileges. The flaw is exploitable only when an application calls pool.run(task, options) with its own options object; calls that omit the options argument use a trusted default and are unaffected. No public exploit code or active exploitation has been identified, and the attack requires a pre-existing prototype-pollution vulnerability in the host application, making real-world exploitation condition-gated.
Prototype pollution in the Tinypool npm package prior to 2.1.1 escalates to code execution: an unauthenticated remote attacker who can first pollute Object.prototype.execArgv or Object.prototype.env.NODE_OPTIONS (via a separate prototype-pollution flaw in the host application) has those inherited values copied into ThreadPool.options and forwarded to worker_threads.Worker, so every newly spawned worker loads attacker-supplied JavaScript through --import/--require preload arguments or NODE_OPTIONS. The payload executes with the host process's privileges, potentially exposing CI secrets, signing material, or build artifacts. The vendor assigns a CVSS 4.0 base score of 9.5 (AT:P - the attack requires an existing pollution primitive), exploitation is not confirmed as actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although the upstream fix commit includes a regression test that demonstrates the execArgv/NODE_OPTIONS technique.
Prototype-pollution gadget in the Piscina Node.js worker-pool library allows an attacker who already controls a separate prototype-pollution primitive in the host application to escalate that primitive into worker-thread code preload and execution: an inherited execArgv value is passed straight to the Node.js Worker constructor, an inherited loadBalancer function runs during task scheduling, and inherited env values reshape worker environments. The flaw affects Piscina releases before 4.9.4 (4.x), before 5.3.2 (5.x), and before 6.0.0-rc.5 (6.x RC); exploitation is unauthenticated from Piscina's perspective and needs no user interaction, but the assessed vector (AV:N/AC:H, CVSS 4.0 AT:P) confirms it is not standalone-exploitable without a pre-existing prototype-pollution bug in the consuming application. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Prototype-pollution gadget in the Axios promise-based HTTP client for Node.js and the browser lets a separate, pre-existing prototype-pollution flaw in the same JavaScript process steer how ToFormData serializes outgoing request bodies in Axios 0.28.0 through 0.33.x and 1.15.1 through 1.19.x. Inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values planted on Object.prototype silently rename or reinterpret serialized fields, or make requests fail outright via a polluted maxDepth; a polluted visitor only executes when the attacker already possesses a stronger function-injection primitive, so Axios adds no new code-execution capability on its own. Remote unauthenticated exploitation is inert without that chained second bug, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status; vendor-released patches ship in 0.34.0 and 1.20.0.
Converting an attacker-supplied .docx file with mammoth.js before 1.12.2 allows unauthenticated remote attackers to inject arbitrary properties into Object.prototype via the document's style definitions (CWE-1321 prototype pollution). In versions 1.11.0 through 1.12.1 the pollution can additionally be leveraged to read local server files and disclose them to the document supplier, but only where the application converts further documents in the same long-lived Node.js process and returns the converted HTML back to that party. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch: 1.12.2.
Prototype pollution in the deepmerge JavaScript library (all versions through 4.3.1) allows an attacker who controls a source object passed into a merge operation to inject properties such as '__proto__', 'constructor', or 'prototype' into the resulting object's prototype chain. The impact is latency-dependent: applications that merge untrusted data (for example, a JSON request body) and then read properties without own-property checks will silently inherit attacker-chosen values, which can corrupt application logic, bypass authorization checks, or influence downstream behaviour. The flaw is a library primitive rather than a standalone exploit, and no public exploit code was identified at time of analysis; the vendor CVSS 4.0 score of 8.7 reflects integrity impact only (VC:N/VA:N), and an independent assessment rates it considerably lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) because exploitation requires the consuming application to both pass attacker-controlled source objects and perform unchecked inherited-property reads.
Prototype pollution in Builder.io Gen2 SDKs at versions ≤5.2.11 (React, Vue, Svelte, Solid) and ≤0.25.13 (Qwik, Angular, React Next.js) lets an attacker who can supply a malicious content block - for example an authenticated content editor or author with write access to a Builder.io space - inject binding keys containing __proto__, prototype, or constructor paths that the deep-set helper processes during block rendering without validation. The result is pollution of Object.prototype with high integrity impact (VI:H) and limited confidentiality/availability impact (C:L/A:L): every object created later in the same process inherits the tainted properties, so in multi-tenant or shared SSR/rendering deployments one tenant's crafted content can contaminate other tenants' renders. Exploitation requires a low-privileged position (PR:L, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), and single-tenant sites that render only trusted first-party content have substantially reduced practical exposure; no public exploit identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but conditional risk rather than a top-tier emergency.
Prototype pollution in the yayson npm JSON:API library (<= 4.2.0) lets a remote attacker corrupt Object.prototype by submitting a document whose resource type is "__proto__". Store/LegacyStore use the attacker-supplied type, id, and relationship names as plain-object keys in internal lookup tables, so a crafted JSON:API payload writes attacker-controlled key/value pairs onto every object in the Node.js process for its lifetime. Proof-of-concept code is published in the GitHub Security Advisory; there is no evidence of active exploitation. The guaranteed impact is process-wide denial of service and logic corruption, with escalation to authorization bypass or RCE dependent on gadgets in the consuming application.
Prototype pollution in isomorphic-git before 1.42.0 allows an operator of a malicious Git server to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation, enabling credential theft when the victim's onAuth callback is triggered. The getRemoteInfo function fails to sanitize ref path components before using them as property keys on JavaScript objects, so a ref such as '__proto__/corsProxy' causes all subsequent network operations within the affected isomorphic-git instance to route through an attacker-controlled proxy. No public exploit or CISA KEV listing has been identified at time of analysis; the fix is confirmed in v1.42.0 released 2026-09-10.
Remote code execution in sift.js 17.1.3 arises because the library enumerates query keys with for...in, which traverses the prototype chain, and dispatches the $where operator by compiling its string value via new Function whenever CSP_ENABLED is unset (the default). An attacker who can either supply an untrusted query object containing a string $where, or who has established a prototype-pollution primitive elsewhere in the process (setting Object.prototype.$where), achieves arbitrary JavaScript execution - in the pollution case even benign calls like sift({}) trigger it. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory documents the mechanism in detail.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. Depending on the downstream dependency tree, exploitable outcomes range from reliable denial of service to remote code execution via prototype-pollution gadget chains; no public exploit or active exploitation is confirmed at time of analysis.
Prototype pollution in exceljs-hardened before 5.0.0 lets a remote attacker corrupt Object.prototype by feeding parsed JSON containing a malicious __proto__ property into a cell note, because the deepMerge helper in the note-serialization path fails to reject __proto__, constructor, or prototype keys. Any application that uses this library to process untrusted spreadsheet or note data is affected, and polluting the global prototype can cascade into denial of service, logic tampering, or code execution via downstream gadgets. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote code execution in OpenSearch Dashboards 3.0.0-3.7.x allows an authenticated low-privileged user to fully compromise the server via a prototype pollution flaw in the Time Series Visual Builder (TSVB) plugin. By sending a crafted JSON payload to the metrics visualization API endpoint, an attacker can corrupt the Node.js object prototype chain and achieve arbitrary server-side code execution. Vendor-released patch is available at version 3.8.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Prototype pollution in the gettext-converter npm library's js2i18next() function enables an attacker who can supply crafted translation data to write arbitrary values onto Object.prototype, corrupting the shared prototype chain for the entire Node.js runtime. All versions of gettext-converter below 1.3.3 are vulnerable when the consuming application passes PO or i18next JS translation objects from an untrusted or user-controlled source to the function. Impact ranges from denial of service through malformed object behavior to potential downstream logic bypasses, depending on how polluted properties interact with application code. No public exploit is identified at time of analysis and no CISA KEV listing exists; vendor-released patch is confirmed at version 1.3.3.
Persistent XSS in Zabbix Maps is triggered by prototype pollution in the searchParamsToObject() function, which processes URL query parameters without filtering reserved JavaScript properties such as __proto__. An authenticated low-privilege attacker can craft a malicious URL that pollutes Object.prototype; when a victim user views the Maps page, jQuery's unsafe DOM element creation traverses the poisoned prototype chain and executes the attacker-controlled payload in the victim's browser session. No public exploit code and no CISA KEV entry have been identified at time of analysis, but the vulnerability class is well-understood and reproducible by intermediate-level attackers.
Prototype pollution in ApostropheCMS 4.32.0 and earlier enables an authenticated editor to trigger a persistent, process-wide denial of service via a single PATCH REST API request. By sending `{ "toString.call": "x" }` to `PATCH /api/v1/article/:id`, the attacker walks the JavaScript prototype chain through `apos.util.set()` into the shared `Object.prototype.toString` function object and shadows its `call` method, breaking every subsequent `Object.prototype.toString.call()` invocation in Node.js - including those inside the MongoDB driver - until the server process is manually restarted. No separate proof-of-concept repository has been published, but the exact attack payload is fully disclosed in the public GitHub security advisory GHSA-vmg4-6gfg-83qx and the upstream commit diff, and active exploitation has not been confirmed by CISA KEV.
Prototype pollution in Trigger.dev's run metadata API (versions 3.3.8 through 4.5.5) lets any authenticated tenant corrupt the shared Node.js webapp process's Object.prototype by supplying crafted path keys to the PUT /api/v1/runs/:runId/metadata endpoint. The root cause is the unsanitized use of attacker-supplied operation.key values passed directly to JSONHeroPath.set() in packages/core/src/v3/runMetadata/operations.ts without filtering __proto__, constructor, or prototype segments. A single exploiting tenant can corrupt Prisma ORM queries, poison Prometheus metric labels, break other tenants' worker authentication, and cause a process-wide denial of service - making this a multi-tenant isolation failure with scope-changed impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Prototype pollution in n8n's Edit Fields (Set) node allows any authenticated user with workflow execution permissions to corrupt a shared global in the main Node.js process, triggering an instance-wide denial of service that locks out all users until a manual process restart. Affected are all n8n releases before 1.123.67, 2.31.5, and 2.32.1 across the 1.x and 2.x branches. The attack requires only a low-privilege authenticated account and no special configuration, making this a high operational priority for any multi-user or shared n8n deployment; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Prototype pollution in @phun-ky/defaults-deep prior to version 2.0.5 allows remote unauthenticated attackers to write arbitrary properties to Object.prototype by supplying crafted objects containing keys such as __proto__, constructor, or prototype to the defaultsDeep() function. The root cause is that the library performed recursive object merging without filtering these special property names, enabling full process-wide prototype chain manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and exploitation is straightforward wherever untrusted input reaches the affected function.
Prototype pollution in the @instana/core Node.js tracer, part of IBM Observability with Instana Agent builds 1.0.303 to 1.0.320, allows a local attacker to inject arbitrary properties into JavaScript object prototypes. This can lead to information disclosure and high integrity impact. No public exploit or active exploitation reported; vendor patch is available.
Remote denial of service in find-my-way (the HTTP router underneath Fastify) affects all versions up to and including 9.6.0 when the router serves requests from a Node.js HTTP/2 server. Because the internal method-to-tree map is a plain JavaScript object, an unauthenticated attacker can send a request whose HTTP method is an inherited Object property name such as constructor, toString, or __proto__, causing find() to treat a prototype value as a router node and crash the process on currentNode.prefix.length. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trigger is trivial and a fixed release (9.7.0) is available.
Privilege escalation via prototype pollution in n8n workflow automation lets an authenticated low-privilege user (holding the default workflow:create permission) corrupt Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. Once polluted, subsequent unauthenticated requests are evaluated as a privileged user, exposing internal user and project listing endpoints. This is an information-disclosure and access-control flaw with no public exploit identified at time of analysis; CVSS 4.0 base score is 7.1.
AdonisJS Bodyparser versions 10.1.3-10.1.4 and 11.0.0-next.9-11.0.2 are
Prototype pollution in JetBrains YouTrack's websandbox bridge (all versions before 2026.2.16593) lets an attacker who can reach the sandbox boundary corrupt JavaScript Object.prototype, potentially escaping the sandbox or disclosing information. The flaw was internally reported by JetBrains and classed as CWE-1321; it carries a vendor-published CVSS of 9.8, but no public exploit has been identified at time of analysis and EPSS rates exploitation probability low at 0.40% (32nd percentile).
Prototype pollution in Style Dictionary's `convertTokenData()` utility function allows an attacker who can supply token data with a `__proto__`-keyed entry to corrupt `Object.prototype` globally, affecting all downstream object operations in the same runtime. All deployments using versions 4.3.0 through 5.4.3 on npm are affected, with severity scaling sharply by context: Node.js server applications ingesting untrusted token data face high-impact exploitation, while build-time-only pipelines with controlled token sources face low residual risk. A publicly available proof-of-concept exists (GitHub Gist), though SSVC signals exploitation activity as none at time of analysis.
Prototype pollution in the npm package scim-patch (versions <= 0.9.0) allows authenticated SCIM provisioning clients to mutate Object.prototype process-wide by submitting a PATCH operation whose value object contains a key such as `__proto__.someProp` or `constructor.prototype.someProp`. Because the side effect persists for the lifetime of the Node process and leaks into every plain object, downstream code that checks flags like `req.user.isAdmin` against unpolluted plain objects can suffer privilege escalation, logic bypass, or denial of service. Publicly available exploit code exists (proof-of-concept in the GHSA advisory and now in the package's test suite); no public exploit identified as in-the-wild use at time of analysis.
Prototype pollution in deepstream.io versions prior to 10.0.5 allows an authenticated client with write permission to any record to corrupt the Node.js Object prototype by submitting record-update messages whose path contains tokens such as __proto__, constructor, or prototype. Because deepstream's permission valve and record-transition pipeline both invoke setValue with the attacker-controlled path, polluting the prototype can taint subsequent permission and transition logic and lead to privilege escalation across all connected clients. No public exploit identified at time of analysis, though the upstream commit (54b8e29) and patch tests publicly demonstrate the exact vulnerable path semantics.
Sandbox escape via prototype pollution in ThingsBoard (versions prior to v4.3.1.2) allows a TENANT_ADMIN-authenticated user to achieve arbitrary code execution within the tb-js-executor sandboxed JavaScript context. The flaw lets a rule-chain script reach the host realm through the `args.constructor.constructor` chain (e.g., synthesizing a Function that returns `process`), defeating the intended VM isolation. No public exploit identified at time of analysis, though the upstream regression test in PR #15600 effectively documents the escape technique.
Denial of service in n8n workflow automation platform (versions prior to 2.24.0) allows an authenticated user with workflow create/edit permissions to trigger global prototype pollution via a crafted table parameter in the Microsoft SQL node. The pollution of Object.prototype persists for the lifetime of the n8n process, causing application-wide validation failures until the server is restarted. No public exploit identified at time of analysis, though the vendor advisory provides clear technical detail.
Remote prototype pollution in i18next-http-middleware before 3.9.7 allows unauthenticated attackers to write to Object.prototype by submitting dotted request-body keys such as '__proto__.polluted' to the missingKeyHandler. The 3.9.3 denylist blocked only literal unsafe keys; downstream backends (notably i18next-fs-backend ≤ 2.6.5) that split missing-key strings on the configured keySeparator then walked these segments into an unguarded setPath(). No public exploit identified at time of analysis, but PoC payloads are embedded in the upstream security test suite.
Prototype pollution in i18next-fs-backend versions prior to 2.6.6 allows remote attackers to write arbitrary properties onto Object.prototype by submitting crafted missing-translation keys such as '__proto__.polluted' to applications that expose i18next-http-middleware's missingKeyHandler to untrusted input. Backend.writeFile() split keys on the configured keySeparator (default '.') and the getLastOfPath walker in lib/utils.js did not filter unsafe segments before traversing the target object. No public exploit identified at time of analysis, but a coordinated-disclosure advisory (GHSA-2933-q333-qg83) and a fixing commit are public, and downstream impact can include denial of service, configuration poisoning, and bypass of property-based security checks.
Prototype pollution in ApostropheCMS versions up to and including 4.30.0 allows an authenticated editor to poison Object.prototype via the $pullAll patch operator, ultimately bypassing authorization on all piece-type REST API endpoints for unauthenticated requests until the Node.js process restarts. The flaw stems from apos.util.set() failing to sanitize __proto__ in dot-notation paths, and no public exploit identified at time of analysis but the advisory describes a confirmed exploitation gadget in publicApiCheck(). No vendor-released patch identified at time of analysis, making this an open-window risk for any internet-exposed editor account.
Denial-of-service and HTTP header injection in the axios npm package (>=1.0.0,<1.16.0 and <=0.31.1) arise from two read-side prototype-pollution gadgets in lib/utils.js merge() and lib/core/mergeConfig.js, allowing a polluted Object.prototype (typically from an upstream dependency such as lodash CVE-2018-16487) to inject arbitrary outbound headers or crash every axios call with a synchronous TypeError. Publicly available exploit code exists in the GHSA advisory PoC, but EPSS is only 0.04% (13th percentile) and SSVC marks Automatable=no with partial technical impact, so this is a credible secondary-gadget risk rather than a mass-exploitation target.
Prototype pollution in the @nevware21/ts-utils npm library (versions <= 0.13.0) lets an attacker who can influence an object passed to objDeepCopy() or objCopyProps() inject a __proto__ (or constructor/prototype) key that overwrites Object.prototype for the entire application. The flaw stems from _copyProps() in lib/src/object/copy.ts iterating with for...in and no hasOwnProperty guard, so parsing untrusted JSON and deep-copying it is enough to poison every object. A working proof-of-concept is published in the GHSA advisory, though EPSS is very low (0.06%) and the issue is not on CISA KEV, so publicly available exploit code exists but no active exploitation is confirmed.
Cookie-attribute injection in js-cookie versions 3.0.5 and earlier allows remote attackers to override security-relevant Set-Cookie attributes (domain, secure, samesite, expires, path) by supplying a JSON-derived attributes object containing a __proto__ key. Publicly available exploit code exists in the GHSA-qjx8-664m-686j advisory demonstrating per-instance prototype hijack via the assign() helper. No active exploitation has been observed, and the issue is fixed in 3.0.7.
Prototype pollution in the @tmlmobilidade/utils npm package allows remote unauthenticated attackers to inject properties into Object.prototype via the setValueAtPath() helper, leading to integrity compromise and partial availability impact in any downstream application that passes user-influenced paths into the function. The flaw is rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N) and is fixed in version 20260509.0340.15; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Prototype pollution in the npm package parse-nested-form-data version 1.0.0 and earlier allows unauthenticated remote clients to mutate Object.prototype of the running Node.js process by submitting a FormData field whose name contains __proto__ in bracket or dot notation. The flaw resides in handlePathPart in src/index.ts, which walks nested path segments without filtering reserved keys, so a single crafted field name pollutes the prototype chain of every plain object in the process. No public exploit identified at time of analysis, but a working proof-of-concept is published in the GHSA advisory itself.
Prototype pollution in the npm package form-data-objectizer (<= 1.0.0) lets unauthenticated remote attackers mutate Object.prototype by submitting a single HTTP form field whose name uses bracket notation such as __proto__[polluted] or constructor[prototype][polluted]. The defect lives in treatInitial/treatSecond inside index.cjs, where an 'in' check walks the prototype chain and lets the parser write to inherited properties. CVSS is 8.2 (High) with Integrity:High; publicly available exploit code exists (working PoC published in the GHSA advisory), but there is no public exploit identified as being used in attacks and no CISA KEV listing.
Prototype pollution in the jsondiffpatch JavaScript library before 0.7.6 allows attackers to modify Object.prototype by supplying crafted delta documents to jsondiffpatch.patch() or JSON Patch documents to the jsonpatch formatter's patch() API. Because attacker-controlled key names and JSON Pointer path segments were used to traverse and mutate objects without filtering __proto__, constructor, or prototype, any application that feeds untrusted diffs into the library can have global object behavior tampered with. A public POC exists in the Snyk advisory and an accompanying gist, but there is no public exploit identified at time of analysis (not on CISA KEV).
Prototype pollution in @ranfdev/deepobj npm package (versions ≤1.0.2) allows remote unauthenticated attackers to modify JavaScript object prototypes when property paths containing '__proto__', 'constructor', or 'prototype' are processed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation against network-accessible applications, though real-world impact depends critically on whether user-controlled input is passed to property path parameters. EPSS data unavailable; not listed in CISA KEV. Publicly available exploit code exists (GitHub advisory GHSA-x7q7-fchv-8h2j). Vendor-released patch available in version 1.0.3.
Remote code execution in n8n workflow automation platform is possible via a prototype pollution patch bypass in the XML node, affecting versions prior to 1.123.43, 2.20.7, and 2.22.1. Authenticated users with workflow creation or modification permissions can bypass the prior fix for GHSA-hqr4-h3xv-9m3r and, by chaining the XML node with other nodes, achieve code execution on the n8n host. No public exploit identified at time of analysis, though EPSS is low (0.05%) suggesting limited near-term mass exploitation despite the high CVSS 4.0 score of 9.4.
Prototype pollution leading to remote code execution in n8n workflow automation platform allows authenticated users with workflow create/modify permissions to corrupt the global Object prototype via an unvalidated pagination parameter in the HTTP Request node. Affecting n8n versions before 1.123.43, 2.20.7, and 2.22.1, the flaw chains with other techniques to escalate to full instance compromise. No public exploit identified at time of analysis, with EPSS at 0.05% (16th percentile) indicating low observed exploitation interest despite CVSS 4.0 9.4 critical rating.
Prototype pollution in protobufjs allows denial of service through corrupted JavaScript built-ins when parsing untrusted schemas. Attackers who control protobuf schemas or JSON descriptors can write to inherited object properties on global constructors, causing process-wide state corruption that persists until restart. CVSS 7.5 (High) with network vector and no authentication required, but real-world risk is limited to applications parsing schemas from untrusted sources-applications only decoding untrusted message payloads with trusted schemas are not affected. Vendor-released patches available: v7.5.6 and v8.0.2. No active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis.
Prototype pollution in @rvf/set-get allows remote attackers to modify Object.prototype on Node.js servers processing form data via Remix or React Router applications. The setPath function fails to block dangerous property keys (__proto__, constructor, prototype) when flattening form submissions, enabling unauthenticated attackers to inject arbitrary properties into all JavaScript objects across the server process with a single malformed HTTP request. Working proof-of-concept code is publicly available demonstrating property injection via field names like '__proto__[polluted]'. The vulnerability affects default configurations with no special setup required - any endpoint using parseFormData or createValidator is exploitable. CVSS 8.2 High severity driven by network attack vector (AV:N), low complexity (AC:L), and no authentication requirement (PR:N), with high integrity impact from the ability to alter application logic process-wide.
Prototype pollution in the velocityjs npm package (Velocity.js <= 2.1.5) lets an attacker who controls template content poison Object.prototype through the #set directive, enabling denial of service and, depending on server-side gadgets, remote code execution. The flaw stems from unvalidated path-key assignment in /src/compile/set.ts, which writes attacker-supplied keys directly onto the target object. Publicly available exploit code exists (a working PoC is published in the GHSA advisory); there is no evidence of active exploitation, and the EPSS score is very low at 0.08% (23rd percentile).
Prototype pollution read-side gadgets in the axios HTTP adapter (npm, versions >=1.0.0 to <1.15.2) allow an attacker who has already polluted Object.prototype in the same Node.js process to hijack every outbound request - injecting attacker-controlled Authorization headers, redirecting relative-URL requests to an external server, pointing requests at internal Unix sockets (SSRF/container escape), forcing Node's insecure HTTP parser, and even executing an attacker-supplied beforeRedirect callback. The flaw stems from five config properties (auth, baseURL, socketPath, beforeRedirect, insecureHTTPParser) being read via direct property access that traverses the prototype chain, unlike eight sibling properties already guarded by an own() helper. A working proof-of-concept is published in the GHSA advisory, but EPSS is only 0.03% and the issue is not in CISA KEV - no public exploit identified at time of analysis as a standalone attack, and it requires a separate prototype pollution primitive to fire.
Prototype pollution in n8n's XML node allows authenticated workflow editors to achieve remote code execution through global prototype manipulation. The vulnerability affects n8n workflow automation platform versions prior to 1.123.32, 2.17.4, and 2.18.1, enabling attackers with workflow creation privileges to inject malicious properties into JavaScript object prototypes that can be exploited by other nodes to execute arbitrary code. Vendor-released patches are available for all affected version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS 10.0 score reflects the critical scope change and complete system compromise potential.
Prototype pollution in n8n's XML webhook parser (xml2js library) enables remote code execution when chained with Git node SSH operations. Authenticated users with workflow editing permissions can inject malicious XML payloads to pollute JavaScript object prototypes, then leverage the polluted prototype in Git node operations to execute arbitrary code on the n8n host server. GitHub advisory GHSA-q5f4-99jv-pgg5 confirms patches available in versions 1.123.32, 2.17.4, and 2.18.1. No CISA KEV listing or public POC identified at time of analysis, but the CVSS 10.0 score appears inconsistent with the authenticated (PR:L expected) nature described in the advisory.
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification of all JSON responses or complete HTTP transport hijacking when the JavaScript Object.prototype has been polluted by a co-dependency. This vulnerability requires a separate prototype pollution source within the same Node.js process but requires no authentication once that precondition exists. An attacker can then access credentials, headers, and request bodies across the application. EPSS data not available; no public exploit identified at time of analysis.
Prototype pollution in Adobe Acrobat Reader allows arbitrary code execution when victims open malicious PDF files. Affects Acrobat Reader versions through 26.001.21411, 24.001.30360, and 24.001.30362. Attack requires local file access with user interaction (CVSS AV:L/UI:R) but achieves scope change and full CIA impact (S:C/C:H/I:H/A:H), yielding CVSS 8.6. No public exploit identified at time of analysis. Vendor advisory available from Adobe (APSB26-44). EPSS data not provided; exploitation status limited to user-interaction-dependent local attack vector.
Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execution in user context via malicious PDF files. Attack requires user interaction to open a crafted document. CVSS 9.6 (Critical) reflects network-deliverable code execution with scope change, though EPSS 0.24% (46th percentile) suggests moderate real-world exploitation probability. No public exploit identified at time of analysis.
Prototype pollution in the LangSmith JavaScript/TypeScript SDK (npm 'langsmith', versions <= 0.5.17) lets an attacker who controls object keys passed to the createAnonymizer() API pollute Object.prototype for the entire Node.js process. The internally vendored lodash set() utility guards only the __proto__ key and misses the constructor.prototype traversal path, so a crafted key like 'constructor.prototype.polluted' bypasses the fix. Publicly available exploit code exists (SSVC 'poc' plus regression tests in the fix PR), but EPSS is only 0.04% with no evidence of active exploitation; notably the vendor GHSA rates this Medium (~CVSS 5.6), conflicting sharply with the NVD 9.8.
Prototype pollution in defu npm package (≤6.1.4) allows remote attackers to override application logic by injecting __proto__ keys through unsanitized user input. The vulnerability enables authentication bypass and arbitrary property injection when applications merge untrusted JSON, database records, or configuration data using defu(). CVSS 7.5 (High) with network-accessible, low-complexity exploitation requiring no authentication. No active exploitation confirmed (not in CISA KEV), but public proof-of-concept exists in the GitHub advisory demonstrating admin privilege escalation.
Prototype pollution in MikroORM's Utils.merge function allows attackers to modify JavaScript object prototypes when applications pass untrusted user input into ORM operations. Affects @mikro-orm/core npm package, enabling denial of service and potentially SQL injection when polluted properties influence query construction. No public exploit identified at time of analysis, though GitHub security advisory published by the project maintainers confirms the vulnerability class (CWE-1321).
Prototype pollution in convict npm package version 6.2.4 allows attackers to bypass previous security fixes and pollute Object.prototype through crafted input that manipulates String.prototype.startsWith. The vulnerability affects applications processing untrusted input via convict.set() and can lead to authentication bypass, denial of service, or remote code execution if polluted properties reach dangerous sinks like eval or child_process. A working proof-of-concept exploit demonstrating the bypass technique exists in the advisory.
Prototype pollution in Mozilla's node-convict configuration library allows attackers to inject properties into Object.prototype via two unguarded code paths: config.load()/loadFile() methods that fail to filter forbidden keys during recursive merge operations, and schema initialization accepting constructor.prototype.* keys during default-value propagation. Applications using node-convict (pkg:npm/convict) that process untrusted configuration data face impacts ranging from authentication bypass to remote code execution depending on how polluted properties propagate through the application. This represents an incomplete fix for prior prototype pollution issues (GHSA-44fc-8fm5-q62h), with no public exploit identified at time of analysis.
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenticated users with workflow creation or modification permissions to achieve remote code execution. Versions prior to 2.14.1, 2.13.3, and 1.123.27 are affected. The CVSS score of 9.4 (Critical) reflects network-based exploitation with low complexity requiring only low-level authentication, though no current KEV listing or public POC availability is indicated in the provided intelligence.
Prototype pollution in the flatted npm library (versions <= 3.4.1) lets an attacker who controls input to the parse() function leak a live reference to Array.prototype into the returned object, so any later write to that property poisons the global prototype chain. The flaw stems from parse() using attacker-supplied JSON string values such as "__proto__" as raw array index keys without numeric validation. Publicly available exploit code exists (a three-line proof of concept in the GitHub Security Advisory), though EPSS is only 0.01% (2nd percentile) and it is not in CISA KEV.
Parse Server is vulnerable to denial of service when remote attackers craft malicious cloud function names that exploit prototype chain traversal, allowing them to trigger stack overflows and crash the server process. The vulnerability stems from improper property lookup restrictions during function name resolution. A patch is available that limits lookups to own properties only.
Prototype pollution in Apollo Federation before multiple versions.
In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.
Immutable.js provides many Persistent Immutable data structures. versions up to 3.8.3 is affected by improperly controlled modification of object prototype attributes (prototype pollution).
AdonisJS is a TypeScript-first web framework. versions up to 10.1.3 is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 7.2).
Prototype pollution in the Locutus JavaScript library (npm package, versions >= 2.0.12 and < 2.0.39) lets attacker-influenced input passed to the php.strings.parse_str function pollute Object.prototype, bypassing a prior guard. The earlier fix rejected forbidden keys using String.prototype.includes(), but an attacker able to override that method - or supply crafted keys such as constructor[prototype][polluted]=yes - defeats the check; publicly available exploit code exists in the GHSA advisory. EPSS exploitation probability is very low (0.01%, 1st percentile), it is not on CISA KEV, and no public exploit is identified as active in the wild.
Denial of service in the @casl/ability npm package (6.7.5 through 7.0.1) stems from prototype pollution in the rulesToFields() helper, which expands attacker-influenced dotted condition keys through an internal setByPath utility and can overwrite inherited builtins such as Function.prototype.call, corrupting shared objects process-wide and crashing the Node.js process. Only applications that call rulesToFields() on rule conditions whose keys are under an attacker's write influence are affected, and the required access is authenticated (PR:L) with high attack complexity, so exposure is conditional rather than broad. The impact is availability only (no confidentiality or integrity loss), no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, making this a moderate-severity issue rather than an urgent one.
Prototype pollution in Progress Kendo UI for jQuery versions prior to 2026.3.1015 lets an authenticated, low-privileged attacker who can supply data accepted by a model's Model.accept method - such as a crafted server response or record - inject unsafe keys like __proto__, constructor, or prototype into object prototypes, altering application behavior and potentially compromising the confidentiality and integrity of application data. The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires some privilege level and user interaction and that real impact is gated on how the application consumes the polluted objects, with server-side JavaScript (Node) scenarios most exposed. The vendor has released a fix in version 2026.3.1015; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Prototype pollution in the n8n AI workflow builder allows an authenticated user to degrade an instance until it is restarted by creating a workflow node whose name is a reserved key such as '__proto__' and then invoking the connect-nodes operation, which merges node connections using node names as object members without filtering reserved keys. Affected releases are all versions before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1; the impact is availability-only (CVSS 6.0, C:N/I:N/A:H in the vendor's CVSS 4.0 vector; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with no confidentiality or integrity loss and no public exploit identified at time of analysis. Exploitation requires a valid account with the ability to create workflow nodes through the API and access to the AI workflow builder's connect-nodes operation, and it further depends on the attacker supplying the specific crafted node name, which is why the vendor's vector carries an AT:P attack-requirements value.
Prototype pollution in the msgpack5 npm package (all versions prior to 6.1.0) allows attacker-controlled MessagePack input to replace the prototype of a decoded object when the application constructs its msgpack5 instance with an empty or partial options object - a usage pattern that silently drops the default protoAction:'error' guard. A decoded map containing a __proto__ key can then alter inherited properties on that decoded object and influence downstream behavior, although Object.prototype is never modified globally. This is an unauthenticated, network-reachable issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) with moderate severity; the independent assessment rates impact as Integrity Low / Availability Low, and no public exploit code has been identified at time of analysis.
Prototype pollution in the npm package traverse (versions 0.3.6-0.3.9, 0.4.0-0.4.6, 0.5.0-0.5.2, and 0.6.0-0.6.11) lets unauthenticated remote attackers add or overwrite properties on String.prototype, Number.prototype, or Boolean.prototype when an application passes an attacker-controlled path array to set(), as when a path is built directly from an untrusted JSON body. Exploitation is gated entirely on that anti-pattern: the path must cross or end on a primitive value, and plain JSON data is not sufficient to reach the far higher-impact Object.prototype, which requires a non-data path segment such as an object whose toString returns a different value on each call or a Proxy that accepts an assignment without storing it. Impact is limited to low integrity and low availability with no confidentiality effect (vendor CVSS 4.0 score 6.9 Medium; independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no public exploit identified at time of analysis and confirmed fixes available from the vendor in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Prototype-chain manipulation in the oRPC @orpc/json-schema SmartCoercionPlugin (versions prior to 1.14.9) lets a remote, unauthenticated client inject `__proto__` or Object.prototype member names such as `constructor` and `toString` into a request body handled by any procedure that declares an object input schema. Abused successfully, this can steer the single coerced request object so attacker-controlled inherited values are treated as sub-schemas and satisfy the coercer's check, potentially influencing handler logic, Object.assign calls, or configuration lookups, with a secondary information-disclosure angle noted in vendor metadata. Impact is strictly bounded - the global Object.prototype, concurrent requests, other users, and unrelated objects are not modified, legitimate own-property `__proto__` fields are dropped, and downstream schema validation still runs - and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.
Prototype pollution in the JavaScript bindings of Apache Thrift (all versions before 0.25.0) allows unauthenticated remote attackers to corrupt object prototype attributes when an application deserializes attacker-influenced Thrift messages through generated JS code. Impact is integrity-only and limited - the vendor-assigned CVSS 4.0 base score is 6.3, while our independent CVSS 3.1 assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, reflecting that exploitation requires the JS binding to be in the data path and specific object properties to be reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Apache has released a fix in version 0.25.0, which also requires regenerating JS code to be effective.
Prototype replacement in stream-json before 3.6.0 lets a JSON key literally named __proto__ overwrite the prototype of an assembled object, because Assembler and FlexAssembler wrote properties with plain assignment and thereby invoked the inherited setter instead of creating an own data property. Applications that read authorization, feature-flag, or control-flow values through prototype inheritance from a parsed object - or that call Object.prototype methods on it - can consume attacker-controlled inherited properties or hit runtime errors when the prototype is null; the global Object.prototype is never polluted, so impact is confined to the individual parsed object (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, low integrity and availability impact only). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is genuine and its real-world exposure hinges on a disputed threat model: the maintainer documents intended input as locally owned dumps, exports, and logs (AV:L) while the reporter treats untrusted JSON parsing as part of the library contract, and no authentication or user interaction is required once hostile JSON reaches the parser (PR:N/UI:N).
Prototype-pollution-assisted cross-site scripting in the KaTeX math-rendering JavaScript library (versions 0.11.0 through 0.18.2) lets attacker-controlled expressions end up in trusted-rendering mode when an inherited `trust` property is picked up from a polluted prototype, producing clickable `javascript:` links or attacker-chosen external resources in any consuming page that inserts unsanitized KaTeX output. This is not a standalone remote exploit: KaTeX does not create the prototype pollution itself, so a separate pollution primitive (or attacker control over the options object's prototype) must already exist in the host application, rendering an expression alone never executes script, and script execution requires the victim to actively click a crafted link. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the CVSS 4.0 base score is only 2.1 (our independent 3.1 assessment is AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting the compounding prerequisites rather than a broadly reachable XSS bug.
Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write arbitrary properties onto JavaScript's Object.prototype whenever a Vaadin application merges an object it does not control into a chart configuration (e.g. updateConfiguration or a chart series config) or into a component's i18n property. Once injected, those properties are visible to every object in the running client-side application, degrading UI integrity and availability rather than exposing data or yielding direct code execution. Exploitation is conditional - the host application must actually route crafted input containing a __proto__ (or equivalent prototype) key into one of those two merge sinks - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV). Affected ranges are Vaadin 23.0.0-23.6.13, 24.0.0-24.9.20, 24.10.0-24.10.9, 25.0.0-25.1.11 and 25.2.0-25.2.6 across the Maven artifacts and the corresponding @vaadin/charts and @vaadin/component-base npm packages.
Header sanitization bypass in the Axios fetch adapter (npm axios 1.7.0 through 1.19.x) allows attacker-controlled request headers - such as Authorization, caching directives, or metadata-service targeting values - to be applied after Axios has already built a sanitized Request object, enabling scope-changed integrity impact (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N). Exploitation is not standalone: it is a gadget that requires a separate same-process prototype-pollution flaw capable of writing Object.prototype.headers, plus use of the fetch-based transport rather than the default Node HTTP adapter. No public exploit code is identified at time of analysis, but the fix and code change are public in the Axios v1.20.0 release, pull request #11141, and commit d19040bd, so the affected range should be treated as patch-now.
Axios versions 0.27.2 through below 0.34.0, and 1.0.0 through below 1.20.0, can silently upgrade an intended GET into a state-changing HTTP method when a request is sent through the default instance without an explicit method. The flaw is a read-side gadget, not a pollution source: calls such as axios({ url }) or axios.request({ url }) omit a method, so dispatch looks up the method on the prototype chain and honours an Object.prototype.method value planted by an unrelated prototype-pollution vulnerability in the same process. Because a separate pollution primitive must already exist, this is only exploitable as part of a chain, which is why the vendor CVSS 4.0 vector carries AT:P; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vendor scores it 6.9 (AV:N/AC:L/AT:P/PR:N/UI:N, SI:H only), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, treating the unauthenticated network-reachable integrity impact as high but gated on the pollution prerequisite.
Prototype pollution in React Native Worklets versions before 0.12.2 allows unauthenticated remote attackers to trigger a denial of service by supplying a crafted object with a __proto__ property through the Worklets serialization path, causing the React Native application to crash. The flaw exists in clonePlainJSObject and the native SerializableObject serialization, where the __proto__ key modifies the prototype of a cloned object instead of being treated as an own property. No public exploit code or confirmed active exploitation has been identified, but if the malformed data is persisted, the denial of service can persist across application restarts.
Prototype pollution in the unflatten helper of Builder.io Gen2 SDKs (the @builder.io/sdk-react, sdk-vue, sdk-svelte and sdk-solid packages at or below 5.2.11, and sdk-angular, sdk-react-nextjs and sdk-qwik at or below 0.25.13) lets unauthenticated remote attackers poison Object.prototype in a victim's browser by luring the victim into opening a crafted preview link whose builder.userAttributes query parameters carry __proto__ or prototype segments. Exploitation is not automatable against a passive server - it hinges on user interaction (UI:P), because the SDK must actually be running in the victim's browser when the malicious URL is processed, and real harm (DOM XSS, client-side logic tampering, denial of service) only materializes if downstream application code reads the polluted inherited properties. No CISA KEV entry and no public exploit code were identified at time of analysis, and the independent assessment rates real-world risk as moderate-to-low.
Prototype pollution in node-opcua-client versions prior to 2.145.0 lets an attacker who controls OPC UA event or condition field names corrupt Object.prototype through the internal fieldsToJson helper in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts, which assigns unsanitized field names and permits a __proto__.pollutedKey assignment path. Only host applications that feed attacker-controlled event field names into that serialization helper are exposed; a malicious or compromised OPC UA server (or untrusted publisher) must supply the crafted field name AND the application must omit field-name sanitization, which is why the vendor rates attack complexity as high. There is no public exploit identified at time of analysis and no confirmed remote code execution - impact is bounded to denial of service or application logic corruption with no confidentiality exposure, making this a genuinely low-priority issue despite being a real prototype-pollution flaw. The issue is unauthenticated per the CVSS vector (PR:N) and is fixed in 2.145.0.
Prototype pollution in hapijs/joi's messages compilation function allows network-reachable attackers to replace an object's prototype chain by supplying `__proto__` as an error-code key in custom validation messages. Affected versions are joi before 17.13.8 and before 18.2.9. Applications that pass externally-controlled data (e.g., JSON request bodies) to `.messages()` or `.prefs({ messages: ... })` can have downstream code silently broken when it relies on standard `Object.prototype` methods. No public exploit identified at time of analysis, though the patch commit ships a working proof-of-concept test file.
Prototype pollution in n8n's Instance AI workflow summary feature allows authenticated users to disrupt the main n8n process by submitting crafted workflows via the REST API. The `summarizeWorkflowStructure` function in `packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts` uses workflow node names and connection keys as raw JavaScript object keys without sanitization, so keys such as `__proto__` or `constructor` cause nested writes to reach `Object.prototype` in the main process and corrupt the JavaScript runtime state. This renders the n8n instance unreliable or unavailable for subsequent requests, making it a targeted denial-of-service attack requiring only low-privilege API access. No public exploit and no CISA KEV listing have been identified at time of analysis; patches are available in versions 2.37.7 and 2.38.2.