Threats Tagged 'cwe-1321'

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages/core/src/v3/runMetadata/operations.ts without rejecting dangerous constructor and prototype path segments. A caller with a normal environment API key can pollute Object.prototype in the shared webapp process, corrupting Prisma queries and Prometheus labels, breaking other tenants' worker authentication, and causing a process-wide denial of service. This issue is fixed in version 4.5.6.

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArray on Object.prototype before throwing. This prototype pollution makes those properties visible on newly created objects and can cause application integrity and availability impacts. This issue is fixed in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2.

CVE-2026-48170 is a prototype pollution vulnerability in the scim-patch library prior to version 0.9.1. The vulnerability occurs when a SCIM PATCH operation includes a value object with keys like "__proto__.someProp", which modifies Object.prototype globally in the Node.js process. This affects all plain objects and can lead to serious integrity and availability issues. Version 0.9.1 of scim-patch contains a patch for this issue. A workaround involves freezing Object.prototype and other prototypes at process startup to prevent modification.

A prototype pollution vulnerability exists in mermaid-js mermaid prior to versions 10.9.8 and 11.16.1. The issue arises from the way configuration setters merge user-supplied configuration into internal config using a deep-merge helper, which can be exploited if untrusted data is passed directly to these setters. This misuse is outside documented usage, and diagram-supplied configuration is not affected. The vulnerability has a low severity score and is fixed in versions 10.9.8 and 11.16.1.

Mermaid versions from 11.5.0 up to but not including 11.16.1 are vulnerable to prototype pollution via the Architecture Diagrams feature. This occurs when a diagram defines a group with an id of __proto__, which is used directly as an object property key without validation. An attacker able to supply diagram text can exploit this to modify Object.prototype, potentially altering the behavior of the embedding application. The vulnerability is fixed in version 11.16.1.

Eclipse Theia versions 0.7.0 through 1.73.1 contain a vulnerability in the PreferenceUtils.merge function that allows prototype pollution via crafted preference values in workspace settings files. This occurs because the merge function does not reject prototype-related keys, potentially altering application logic when a workspace is opened.

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.

IBM Observability with Instana (Agent) versions 1.0.303 through 1.0.320, specifically the IBM Instana Node.js tracer component @instana/core version 6.2.1, contains a prototype pollution vulnerability via its configuration normalization API. This vulnerability allows improper modification of object prototype attributes, which can lead to integrity and availability impacts. The vulnerability has a CVSS score of 7.3, indicating high severity. No official patch or remediation guidance has been provided yet.

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (__proto__, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application. Version 0.14.0 patches the issue.