Threats Tagged 'cwe-1321'

Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys, potentially causing a Prototype Pollution vulnerability. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototype. Applications that pass user-controlled or partially user-controlled configuration into Jodit.configure() may be vulnerable. This issue was fixed in version 4.12.18.

Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pollution through Jodit.modules.Helpers.set(chain, value, obj), which walks the dot-separated chain, creating and following each path segment without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype. Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable, causing unexpected property injection, logic bypass, denial of service, or secondary security issues. This issue has been fixed in version 4.12.26.

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as normal values by downstream built-in nodes. Where a workflow combines a public webhook with action nodes that consume the resulting fields, an attacker could cause the workflow to act as a confused deputy — targeting unintended records or issuing outbound requests using the workflow owner's configured credentials. This vulnerability is fixed in 2.25.7 and 2.26.2.

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could bypass the patch for CVE-2026-42232 in the XML node. When combined with other nodes, this could lead to RCE on the n8n host. This vulnerability is fixed in 1.123.43, 2.22.1, and 2.20.7.

n8n, an open source workflow automation platform, contains a prototype pollution vulnerability (CWE-1321) in its HTTP Request node. Authenticated users with workflow modification permissions can exploit an unvalidated pagination parameter to achieve global prototype pollution. This vulnerability affects versions prior to 1.123.43, 2.22.1, and 2.20.7. Exploitation combined with other techniques could lead to remote code execution (RCE) on the instance. The issue is fixed in versions 1.123.43, 2.22.1, and 2.20.7.

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rendering the n8n instance completely non-functional until restarted. This vulnerability is fixed in 2.24.0.

CVE-2026-55388 is a high-severity code injection vulnerability in the piscina Node.js worker pool library. Versions prior to 4.9.3, and versions from 4.9.3 up to but not including 5.2.0, improperly handle the filename option by reading it via prototype chain lookup. If Object.prototype.filename is manipulated, an attacker can cause arbitrary .mjs code to run in a worker thread. This vulnerability is fixed starting with versions 4.9.3 and 5.2.0.

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5.

A prototype pollution vulnerability exists in i18next-http-middleware versions prior to 3.9.7. The middleware's missingKeyHandler blocks literal keys like __proto__, constructor, and prototype but does not block dotted variants such as "__proto__.polluted". When used with downstream backends like i18next-fs-backend ≤ 2.6.5 that split keys on a configured separator and write to Object.prototype without proper guards, this can lead to remote prototype pollution. This may cause crashes, corrupted translation behavior, configuration poisoning, or bypasses of property-based security checks. The issue is fixed in version 3.9.7.