Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code exe

• pre-auth RCE
• Prototype pollution

apache · strutsSep 14, 2020

Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

• RCE
• Prototype pollution

adobe · acrobat dcApr 11, 2026

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

• Pre-auth
• Prototype pollution

y18n project · y18nNov 17, 2020

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes c

• Pre-auth
• Prototype pollution

rpyc project · rpycOct 3, 2019

Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

• pre-auth RCE
• Prototype pollution

parseplatform · parse-serverNov 9, 2022

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototyp

• Pre-auth
• Prototype pollution

jquery · jqueryApr 19, 2019

Prototype Pollution in automattic/mongoose

• Pre-auth
• Prototype pollution

mongoosejs · mongooseJul 28, 2022

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

• Pre-auth
• Prototype pollution

linuxfoundation · dojoDec 17, 2021

Kibana arbitrary code execution via prototype pollution

• pre-auth RCE
• Prototype pollution

elastic · kibanaMay 6, 2025

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution

• Pre-auth
• Prototype pollution

mozilla · firefoxDec 22, 2022

If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading t

• Pre-auth
• Prototype pollution

mozilla · firefoxDec 22, 2022

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache

• pre-auth RCE
• Prototype pollution

fasterxml · jackson-databindJul 29, 2019

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.

• pre-auth RCE
• Prototype pollution

handlebars.js project · handlebars.jsDec 20, 2019

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host

• pre-auth RCE
• Prototype pollution

vm2 project · vm2Oct 18, 2021

Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution.

• Pre-auth
• Prototype pollution

beakerbrowser · beakerApr 23, 2020

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.

• Pre-auth
• Prototype pollution

agoric · realms-shimJan 10, 2022

An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading t

• Pre-auth
• Prototype pollution

mozilla · firefoxDec 22, 2022

This affects the package express-fileupload before 1.1.8.

• pre-auth RCE
• Prototype pollution

express-fileupload project · express-fileuploadJul 30, 2020

This affects the package chart.js before 2.9.4.

• Pre-auth
• Prototype pollution

chartjs · chart.jsOct 29, 2020

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

• Pre-auth
• Prototype pollution

substack · minimistMar 17, 2022

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates comi

• Pre-auth
• Prototype pollution

handlebarsjs · handlebarsMay 4, 2021

Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead

• pre-auth RCE
• Prototype pollution

set-or-get project · set-or-getFeb 8, 2021

Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remot

• pre-auth RCE
• Prototype pollution

exodus · fieldNov 12, 2020

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.

• Pre-auth
• Prototype pollution

grpc · grpcNov 11, 2020

This affects the package convict before 6.2.3.

• Pre-auth
• Prototype pollution

mozilla · convictMay 13, 2022