CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
539 vulnerabilities with CWE-1321
CVE-2025-54803
HIGH
js-toml < 1.0.2 - Prototype Pollution via Malicious TOML Input
CVSS 7.5
CVE-2025-34146
HIGH
@nyariv/sandboxjs <= 0.8.23 - Prototype Pollution via Insufficient Prototype Access Checks
CVE-2025-8101
HIGH
linkifyjs 4.3.1 - Prototype Pollution leading to Cross-Site Scripting
CVE-2025-53626
MEDIUM
pdfme 5.2.0-5.4.0 - Prototype Pollution and Cross-Site Scripting via Expression Evaluation
CVSS 6.1
CVE-2025-49223
CRITICAL
billboard.js < 3.15.1 - Prototype Pollution via Generate Function
CVSS 9.8
CVE-2025-48054
MEDIUM
Radashi < 12.5.1 - Prototype Pollution via set Function Path Argument
CVE-2025-5150
MEDIUM
docarray < 0.40.1 - Prototype Pollution via __getitem__ Function
CVSS 6.3
CVE-2025-26621
HIGH
OpenCTI < 6.5.2 - Authenticated Denial of Service via Webhook JavaScript Execution
CVSS 7.6
CVE-2025-25014
CRITICAL
Kibana 8.3.0-8.17.5 - Prototype Pollution via Machine Learning and Reporting Endpoints
CVSS 9.1
CVE-2025-3982
MEDIUM
nortikin Sverchok 1.3.0 - Prototype Pollution
CVSS 4.3
CVE-2025-32014
MEDIUM
estree-util-value-to-estree < 3.3.3 - Prototype Pollution via __proto__ Property
CVE-2025-31475
MEDIUM
Amauri Tarteaucitronjs < 1.20.1 - Prototype Pollution
CVSS 5.5
CVE-2025-3197
HIGH
expand-object >=0.0.0 - Prototype Pollution via expand() Function
CVSS 7.3
CVE-2025-25977
CRITICAL
canvg 4.0.2 - Remote Code Execution via StyleElement Constructor
CVSS 9.8
CVE-2025-27597
HIGH
Intlify Message-resolver < 9.1.11 - Prototype Pollution
CVE-2025-25015
CRITICAL
Kibana 8.15.0-8.16.5 and 8.17.1-8.17.2 - Authenticated Remote Code Execution via Prototype Pollution
CVSS 9.9
CVE-2024-14020
MEDIUM
carbone < 3.5.6 - Prototype Pollution in Formatter Handler
CVSS 5.0
CVE-2024-57708
MEDIUM
OneTrust SDK 6.33.0 - Denial of Service via Prototype Pollution
CVSS 5.7
CVE-2024-12556
HIGH
Kibana 8.16.1-8.16.3 - Prototype Pollution and Code Injection via File Upload and Path Traversal
CVSS 8.7
CVE-2024-57083
HIGH
redocly/redoc < 2.2.0 and npm/redoc < 2.4.0 - Denial of Service via Prototype Pollution in Module.mergeObjects
CVSS 7.5
CVE-2024-38988
CRITICAL
alizeait unflatto <= 1.0.2 - Prototype Pollution via exports.unflatto Method
CVSS 9.8
CVE-2024-38985
CRITICAL
janrywang depath and cool-path - Prototype Pollution via setIn Method
CVSS 9.8
CVE-2024-24292
CRITICAL
Aliconnect SDK 0.0.6 - Prototype Pollution via aim Function
CVSS 9.8
CVE-2024-11628
MEDIUM
Telerik Kendo UI for Vue <6.0.1 - Command Injection
CVSS 4.1
CVE-2024-12629
MEDIUM
Progress KendoReact 3.5.0-9.4.0 - Prototype Pollution
CVSS 4.1
Details
Vulnerabilities
539