CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Consequences

• Confidentiality, Integrity, Availability: Read Application Data, Modify Application Data
• Availability: DoS: Crash, Exit, or Restart

How to prevent it

• Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
• Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
• Implementation: When handling untrusted objects, validating using a schema can be used.
• Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
• Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

Recent advisories

• GHSA-6wvx-3r32-xmcg — Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
• GHSA-7648-jmwf-vw7j — systeminformation has prototype pollution in `networkStats()` via the interface name
• GHSA-m2m5-rw3w-cwmj — ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
• GHSA-j5rq-xfvr-p969 — ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
• GHSA-97rh-rhh2-7vjv — Payload: Remote Code Execution through first-register
• GHSA-4q55-j62x-fr9h — devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
• GHSA-x97p-jq2g-jp4f — Axios: Prototype Pollution Gadget in axios toFormData Options
• GHSA-vh66-26gq-q6x8 — Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
• GHSA-m8m8-qj5v-23w3 — Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
• GHSA-j8rh-479h-cp32 — Axios: Header Injection via Inherited headers After Minimal Interceptor
• GHSA-9fr6-4gfg-395g — Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
• GHSA-4hqw-qxg8-jxx2 — Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
• GHSA-3vgf-8m4q-q4qr — vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
• GHSA-679f-58pq-4v2c — n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
• GHSA-vmg4-6gfg-83qx — ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

All advisories for CWE-1321