CWE-1321
CVEs classified under CWE-1321, newest first.
172 CVEsRSS
CVE-2026-71437MediumMermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group…
CVE-2026-71438LowMermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConf…
CVE-2026-70610Medium· 5.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could car…
CVE-2026-67319Noneaxios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged con…
CVE-2026-67316Low· 3.7axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axio…
CVE-2026-67314High· 7.4axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js)
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-po…
CVE-2026-53609Critical· 9.1Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
CVE-2026-54756MediumJodit has prototype pollution via Jodit.configure() / ConfigMerge
Jodit has prototype pollution via Jodit.configure() / ConfigMerge
CVE-2026-54737High· 7.3@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, a…
CVE-2026-54639High· 8.8Style Dictionary - Prototype Pollution in convertTokenData utility function
Style Dictionary - Prototype Pollution in convertTokenData utility function
CVE-2026-47219High· 7.5find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server (CVE-2026-47219)
A flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause …
GHSA-3r53-75j5-3g7jMedium· 5.6Quasar: Prototype pollution in the extend() utility
Quasar: Prototype pollution in the extend() utility
GHSA-866w-xmhq-wj7xMedium· 4.3SvelteKit: Prototype pollution in file input deletion path in remote-function forms
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
GHSA-664h-wqgq-64gwMedium· 6.5Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
CVE-2026-65913Medium· 6.1DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like oncli…
GHSA-xwx6-jjhv-84p8Highn8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
GHSA-hx4h-vr3m-45vhMediumn8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
CVE-2026-59206Highn8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
GHSA-mmx7-hfxf-jppxMediumAxios: Prototype pollution gadgets can alter axios request construction
Axios: Prototype pollution gadgets can alter axios request construction
GHSA-7q8q-rj6j-mhjqMediumAxios: Nested axios option objects can consume polluted prototype values
Axios: Nested axios option objects can consume polluted prototype values
GHSA-gcfj-64vw-6mp9HighAxios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
GHSA-xj6q-8x83-jv6gMediumAxios: Prototype pollution auth subfields can inject Basic auth
Axios: Prototype pollution auth subfields can inject Basic auth
CVE-2026-16151Medium· 6.3A vulnerability has been found in CartoDB carto-api-client 0.5.29
A vulnerability has been found in CartoDB carto-api-client 0.5.29. This impacts the function addFilter of the file src/filters.ts. Such manipulation of the argument column leads to improperly controlled modification of object prototype a…
CVE-2026-16150Medium· 6.3A vulnerability was found in RobinHerbots Inputmask up to 5.0.9
A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helpe…
CVE-2026-54335Low· 3.7Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
CVE-2026-15538Medium· 6.3A weakness has been identified in primefaces primereact up to 10.9.8
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of …
GHSA-3wcj-gjvf-fvchMedium· 4.8Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
CVE-2026-56763Medium· 4.8Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties
Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using…
CVE-2026-15195Medium· 6.3PoCapidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution
A weakness has been identified in apidevtools json-schema-ref-parser. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototy…
CVE-2026-15187Medium· 4.3A security flaw has been discovered in enquirer up to 2.4.1
A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of objec…