basic-ftp versions prior to 6.2.4 contain a vulnerability in the MLSD directory-listing parser where untrusted fact names from the FTP server are used as keys without proper validation. This allows a specially crafted fact named __proto__ to bypass handler checks and cause a TypeError, leading to unhandled promise rejections that can terminate the Node.js process in versions 15 and later if not handled by the application. The issue is fixed in version 6.2.4.
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by Schema.path() and Schema.add(). An attacker who can influence virtual field names in dynamic schemas, content-management form builders, or schema-as-code systems can supply path segments such as __proto__, constructor, or prototype, causing the virtual-path reducer to write enumerable properties to Object.prototype or Function.prototype. The resulting prototype pollution can spoof inherited property checks such as authorization flags and can provide function-prototype gadget state to other server-side JavaScript code. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can therefore cause Mongoose to write into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or Query.prototype.merge() source can overwrite Object.prototype.toString.call, causing later queries on unrelated models to fail until the process restarts. Separately, when an attacker controls the dotted path passed to doc.set(path, value) for a subdocument configured with strict: false, descent through $__set can reach $__schema and alter shared validators or schema options for later documents. Mongoose already blocks __proto__, constructor, and prototype, so this issue overwrites properties on reachable shared objects rather than adding new properties directly to Object.prototype. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.
A prototype pollution vulnerability exists in the setter utility of Progress Software KendoReact versions 3.5.0 through 16.0.0. This flaw allows a high-privileged attacker who can control a field path passed to the utility, including via components like Form, Scheduler, and Gantt, to modify the prototype of built-in objects. The impact on confidentiality, integrity, and availability is limited. The issue is fixed in version 16.1.0.
CVE-2026-106144 is a prototype pollution vulnerability in the Scheduler component of Progress Software Kendo UI for Angular versions prior to 25.1.0. This flaw allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects. The impact is limited to confidentiality, integrity, and availability. The vulnerability has a medium severity with a CVSS score of 4.1 and was fixed in version 25.1.0.
A prototype pollution vulnerability exists in the graphql-tools package from versions 10.10.1 up to but not including 12.0.2. The mergeIncrementalResult helper function improperly handles path segments without validating primitive types, allowing an attacker to write malicious properties to Object.prototype. This occurs when merging untrusted incremental GraphQL responses using @defer or @stream directives. The issue is fixed in version 12.0.2.
A prototype pollution vulnerability exists in the GraphML decoder of draw.io versions prior to 31.1.5. An attacker can craft malicious GraphML files that manipulate inherited object properties, including prototype objects, leading to client-side prototype pollution. This can be exploited in a cross-site scripting (XSS) chain when the editor is opened in Trello mode and the Trello integration is invoked after import, allowing script execution in the draw.io origin. The vulnerability is fixed in version 31.1.5.
CVE-2026-63402 is a vulnerability in the i18next JavaScript internationalization framework prior to version 26.3.4. It involves the deepExtend function improperly recursing into inherited built-in objects, allowing an attacker to overwrite properties of shared built-in functions process-wide when specific parameters are used. This can cause unrecoverable denial of service by breaking internal function calls. The issue is fixed in version 26.3.4.
A prototype pollution vulnerability exists in digitalbazaar forge versions prior to 1.4.1. The forge.http client improperly stores cookie names and paths from Set-Cookie headers in plain JavaScript objects, allowing a malicious server to manipulate Object.prototype by using special cookie names such as __proto__ or constructor. This can lead to modification or deletion of inherited properties on Object.prototype. The issue affects applications using forge.http or forge.xhr and is fixed in version 1.4.1.
Highcharts JS versions from 6.1.0 up to but excluding 11.4.9, 12.0.0 up to but excluding 12.6.1, and 13.0.0 up to but excluding 13.1.0 are vulnerable to prototype pollution via the series.keys property. This allows an attacker controlling series.keys and matching point data to assign arbitrary properties to Object.prototype without user interaction beyond rendering the chart. The vulnerability is fixed in versions 11.4.9, 12.6.1, and 13.1.0.
A prototype pollution vulnerability exists in Highcharts JS versions 13.0.0 up to but not including 13.1.0. The issue arises because series data columns are built using point option keys directly as column IDs, allowing malicious keys like __proto__ and constructor to modify Object.prototype or the Object constructor. This can disrupt page rendering or alter application behavior without user interaction beyond rendering the chart. The vulnerability is fixed in version 13.1.0.
CVE-2026-118248 is a prototype pollution vulnerability in Highcharts JS versions from 1.0.0 up to but not including 4.2.2. The issue arises in Highcharts Dashboards edit mode, where the editableOptions propertyPath segments do not reject prototype-related keys such as __proto__ or constructor. An attacker controlling editableOptions can cause a user's edit to write values onto Object.prototype, affecting JavaScript behavior globally on the page. This vulnerability is fixed in versions 4.2.2 and 13.1.0.
CVE-2026-118247 is a prototype pollution vulnerability in Highcharts JS, a JavaScript charting library. The flaw exists in DataTable single-cell writers that use untrusted column IDs without filtering out __proto__ or constructor keys. This allows writes to Object.prototype or the Object constructor, potentially altering application control flow or disrupting rendering. The vulnerability affects versions prior to 13.1.0, Dashboards before 4.2.3, and Grid Pro before 3.2.0. It requires control over the table or component column ID and a cell, point, or API write to exploit. The issue is fixed in Highcharts 13.1.0, Dashboards 4.2.3, and Grid Pro 3.2.0.
CVE-2026-118243 is a prototype pollution vulnerability in Highcharts JS versions from 1.0.0 up to but not including 4.2.2. The issue arises because Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID, allowing a specially crafted __proto__ table ID to modify Object.prototype. This can disrupt features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and enabled component sync but no user interaction beyond loading the dashboard. The vulnerability is fixed in version 4.2.2.
CVE-2026-116674 is a prototype pollution vulnerability in the systeminformation library for Node.js versions prior to 5.33.13. The issue occurs on FreeBSD, OpenBSD, and NetBSD when the networkStats(ifaces) function uses a sanitized interface name to index a plain-object cache. If the interface name is 'proto', it causes properties to be written onto Object.prototype, potentially corrupting application logic. This vulnerability is fixed in version 5.33.13.
CVE-2026-114142 is a high-severity prototype pollution vulnerability in the BinaryMuse toml-node library for Node.js and browsers. Versions prior to 5.0.1 improperly handle quoted key paths during parsing, allowing attacker-controlled properties to be written to Object.prototype. This can cause objects to inherit malicious properties. The vulnerability is fixed in version 5.0.1.
CVE-2026-107588 is a high-severity cross-site scripting (XSS) vulnerability in Vaadin Charts, which uses a pinned version of the Highcharts library. The vulnerability arises from multiple vectors in the chart configuration, including Object.prototype writes via series.keys paths and XSS through credits.href, breadcrumbs.style, HTML text parsing during printing, and xlink:href attributes in exported charts. Applications are vulnerable if attacker-controlled data reaches these chart configuration options. Vaadin has released fixed versions that apply Highsoft's recommended workarounds while keeping the same Highcharts versions.
ApostropheCMS versions prior to 4.33.0 and db-connect versions prior to 1.1.0 contain a vulnerability where accounts with view-draft access can submit a crafted projection exclusion path that manipulates the prototype chain, leading to deletion of shared runtime members. This causes persistent process-wide integrity and availability issues. The vulnerability affects SQLite, PostgreSQL, and multipostgres adapters but not the default MongoDB adapter. The issue is fixed in ApostropheCMS 4.33.0 and db-connect 1.1.0.
ApostropheCMS versions prior to 4.33.0 contain a cross-site scripting (XSS) vulnerability in the admin bundle. An unauthenticated attacker can craft a link with a specially constructed query string that exploits the apos.http.parseQuery function's handling of prototype-related keys. When an authenticated admin user loads a page with this crafted link, malicious script can execute in their session. This vulnerability is fixed in version 4.33.0.