Base de CVEs

CVE-2026-106160 Média · 5.4 CWE-1321 15/10/2026

Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the application uses the modified objects, including in server-side JavaScript scenarios. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.

CVE-2026-110848 Média · 6.0 CWE-1321 14/10/2026

n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.

CVE-2026-110842 Alta · 7.7 CWE-1321 14/10/2026

n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.

CVE-2026-110111 Alta · 7.5 CWE-1321 13/10/2026

Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.

CVE-2021-48012 Alta · 8.2 CWE-1321 12/10/2026

fast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOML

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.

CVE-2026-107701 Alta · 8.2 CWE-1321 08/10/2026

dot-access through 1.0.0 Prototype Pollution via set() path argument

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.

CVE-2026-107301 Média · 6.5 CWE-1321 08/10/2026

msgpack5: Partial options disable prototype protection

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.

CVE-2026-107353 Média · 6.5 CWE-1321 07/10/2026

traverse: set() can write to built-in prototypes via an untrusted path

traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.

CVE-2026-106448 Alta · 8.9 CWE-1321 06/10/2026

StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.

CVE-2026-105844 Crítica · 9.3 CWE-1321 06/10/2026

Payload: Prototype pollution in Payload Import Export plugin

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

CVE-2026-104852 Alta · 8.2 CWE-1321 05/10/2026

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart. This issue is fixed in version 12.0.1.

CVE-2026-82257 Média · 4.3 CWE-1321 28/08/2026

SvelteKit before 2.69.1 Prototype Pollution via File Input

SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.

CVE-2026-78207 Crítica · 9.4 CWE-1321 23/08/2026

exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization

exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.

CVE-2026-70610 Média · 5.4 CWE-1321 05/08/2026

Electron: contextBridge object copy honors prototype setters

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.

CVE-2026-65913 Média · 6.1 CWE-1321 23/07/2026

DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.

CVE-2026-57926 Crítica · 9.8 CWE-1321 26/06/2026

Prototype Pollution na ponte websandbox do JetBrains YouTrack

Na JetBrains YouTrack anterior à versão 2026.2.16593, a ponte websandbox era vulnerável a um ataque de prototype pollution

CVE-2026-54639 Alta · 8.8 CWE-1321 23/06/2026

Style Dictionary - Prototype Pollution in convertTokenData utility function

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of `convertTokenData(tokens, { output: 'object' });`; indirect usage, via using Expand API; and/or indirect usage via SD's transform lifecycle. Impact is high for this when style-dictionary is used as an integration in a NodeJS server application. Impact is moderate for when style-dictionary is used as an integration in a Web application. Impact is low for most common cases where the user of style-dictionary also maintains the tokens, and access is limited via read/write access to the repository/workflows where it is used. A patch has been published in version `5.4.4`. The only known workaround is to sanitize token data first. Whether using DTCG format or old Style Dictionary format, check the token data object recursively for any object keys that include `__proto__`.

CVE-2026-54306 Média · 6.4 CWE-1321 23/06/2026

n8n: Prototype Pollution enables confused-deputy execution via public webhooks

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as normal values by downstream built-in nodes. Where a workflow combines a public webhook with action nodes that consume the resulting fields, an attacker could cause the workflow to act as a confused deputy — targeting unintended records or issuing outbound requests using the workflow owner's configured credentials. This vulnerability is fixed in 2.25.7 and 2.26.2.

CVE-2026-44791 Crítica · 9.9 CWE-1321 23/06/2026

n8n: Bypass de Correção no Nó XML com Possível RCE

n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes de 1.123.43, 2.22.1 e 2.20.7, um usuário autenticado com permissão para criar ou modificar fluxos de trabalho poderia contornar a correção do CVE-2026-42232 no nó XML. Quando combinado com outros nós, isso poderia levar a RCE no host do n8n. Esta vulnerabilidade é corrigida em 1.123.43, 2.22.1 e 2.20.7.

CVE-2026-44789 Crítica · 9.9 CWE-1321 23/06/2026

n8n: Prototype Pollution no Nó HTTP Request via Parâmetro de Paginação

O n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes de 1.123.43, 2.22.1 e 2.20.7, um usuário autenticado com permissão para criar ou modificar fluxos de trabalho poderia obter prototype pollution global por meio de um parâmetro de paginação não validado no nó HTTP Request. Combinada com outras técnicas, essa vulnerabilidade poderia levar a RCE na instância. Esta vulnerabilidade está corrigida nas versões 1.123.43, 2.22.1 e 2.20.7.

CVE-2026-54312 Alta · 8.5 CWE-1321 23/06/2026

n8n: Microsoft SQL Node Prototype Pollution

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rendering the n8n instance completely non-functional until restarted. This vulnerability is fixed in 2.24.0.

CVE-2026-49252 Crítica · 9.9 CWE-1321 18/06/2026

Poluição de protótipo no servidor deepstream permite escalonamento de privilégios (CVE-2026-49252)

deepstream é um servidor que permite que clientes e serviços de backend sincronizem dados, enviem mensagens e façam RPCs em escala. Versões anteriores à 10.0.5 são vulneráveis a Poluição de Protótipo (Prototype Pollution). A exploração pode levar a um potencial escalonamento de privilégios a partir de qualquer usuário autenticado com permissão de escrita em qualquer registro. Este problema foi corrigido na versão 10.0.5.

CVE-2026-53676 Alta · 7.2 CWE-1321 17/06/2026

Prototype Pollution em Thingsboard

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege (TENANT_ADMIN).

CVE-2026-48714 Crítica · 9.1 CWE-1321 15/06/2026

i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7. If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input.

CVE-2026-48713 Crítica · 9.1 CWE-1321 15/06/2026

i18next-fs-backend: Prototype pollution via crafted missing-key string

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input). Backend.writeFile() splits each queued missing-key string on the configured keySeparator (default .) before calling the internal setPath() walker. The walker (getLastOfPath in lib/utils.js) did not guard against unsafe segments, so a key like "__proto__.polluted" was split into ["__proto__", "polluted"] and walked straight into Object.prototype, allowing an attacker to write arbitrary properties onto the global object prototype. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. Applications are affected only if the missingKeyHandler (or another route that forwards untrusted request bodies to i18next.t(..., { ... }) with saveMissing: true) is reachable by untrusted users and the default behaviour of splitting missing-key strings on keySeparator is in use (i.e. keySeparator is not false). Apps that do not expose missing-key persistence to untrusted input are not directly affected through this attack path. This issue has been fixed in version 2.6.6. If developers using the library are unable to upgrade immediately, they should take the following precautions: do not expose i18next-http-middleware's missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), disable missing-key persistence (saveMissing: false, or no backend.create implementation) when accepting writes from untrusted input, and set keySeparator: false in their i18next options to disable backend key splitting (note: this also disables nested translation keys).