目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1310 元

100%
请我们喝杯咖啡

CWE-1321 类漏洞列表 152

CWE-1321 类弱点 152 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1321 原型污染漏洞属于对象属性控制不当类型。攻击者通过注入恶意输入，修改 JavaScript 对象的原型属性，从而污染全局对象或影响后续实例。这可能导致远程代码执行、拒绝服务或权限提升。开发者应避免直接合并用户输入，使用 Object.create(null) 创建无原型对象，或采用安全库限制原型修改，并严格验证输入来源，以阻断污染路径。

MITRE CWE 官方描述
CWE：CWE-1321 对象原型属性（'Prototype Pollution'）的修改控制不当 英文：产品接收来自上游组件的输入，该输入指定了要在对象中初始化或更新的属性，但它未能正确控制对对象原型（prototype）属性的修改。
常见影响 (2)
Confidentiality, Integrity, AvailabilityRead Application Data, Modify Application Data
This weakness is usually exploited by using a special attribute of objects called proto, constructor, or prototype. Such attributes give access to the object prototype. An attacker can inject attributes that are used in other components by adding or modifying attributes of an object prototype. This …
AvailabilityDoS: Crash, Exit, or Restart
An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
缓解措施 (5)
ImplementationBy freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Effectiveness: High
Architecture and DesignBy blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Effectiveness: High
ImplementationWhen handling untrusted objects, validating using a schema can be used.
Effectiveness: Limited
ImplementationBy using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Effectiveness: High
ImplementationMap can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Effectiveness: Moderate
代码示例 (1)
This function sets object attributes based on a dot-separated path.
function setValueByPath (object, path, value) { const pathArray = path.split("."); const attributeToSet = pathArray.pop(); let objectToModify = object; for (const attr of pathArray) { if (typeof objectToModify[attr] !== 'object') { objectToModify[attr] = {}; } objectToModify = objectToModify[attr]; } objectToModify[attributeToSet] = value; return object; }
Bad · JavaScript
setValueByPath({}, "__proto__.isAdmin", true) setValueByPath({}, "constructor.prototype.isAdmin", true)
Bad · JavaScript
CVE ID标题CVSS风险等级Published
CVE-2026-45302 parse-nested-form-data 通过 FormData 字段名中的 `__proto__` 实现原型污染漏洞 — parse-nested-form-data 8.2 High2026-06-01
CVE-2026-46510 form-data-objectizer 安全漏洞 — form-data-objectizer 8.2 High2026-05-29
CVE-2026-46509 deepobj 安全漏洞 — deepobj 8.2 High2026-05-28
CVE-2026-44483 RVF 安全漏洞 — rvf 8.2 High2026-05-27
CVE-2026-44966 Velocity.js 安全漏洞 — velocity.js 8.3 High2026-05-26
CVE-2026-9101 MongoDB Compass 安全漏洞 — Compass 4.3 Medium2026-05-20
CVE-2026-8657 jsondiffpatch 安全漏洞 — jsondiffpatch 8.2 High2026-05-16
CVE-2026-44005 vm2 代码注入漏洞 — vm2 10.0 Critical2026-05-13
CVE-2026-44292 protobuf.js 安全漏洞 — protobuf.js 5.3 Medium2026-05-13
CVE-2026-44290 protobuf.js 安全漏洞 — protobuf.js 7.5 High2026-05-13
CVE-2026-42264 Axios 安全漏洞 — axios 7.4 High2026-05-08
CVE-2026-42232 n8n 安全漏洞 — n8n 8.8 -2026-05-04
CVE-2026-42231 n8n 安全漏洞 — n8n 9.9 -2026-05-04
CVE-2026-42077 Evolver 安全漏洞 — evolver 5.2 Medium2026-05-04
CVE-2026-42033 Axios 安全漏洞 — axios 7.4 High2026-04-24
CVE-2026-6621 extend-deep 安全漏洞 — extend-deep 7.3 High2026-04-20
CVE-2026-6594 merge 安全漏洞 — merge 7.3 High2026-04-20
CVE-2026-34622 Adobe Acrobat Reader 安全漏洞 — Acrobat Reader 8.6 High2026-04-14
CVE-2026-34626 Adobe Acrobat Reader 安全漏洞 — Acrobat Reader 6.3 Medium2026-04-14
CVE-2026-34621 Adobe Acrobat Reader 安全漏洞 — Acrobat Reader 8.6 High2026-04-11
CVE-2026-40190 LangSmith Client SDKs 安全漏洞 — langsmith-sdk 5.6 Medium2026-04-10
CVE-2026-35209 defu 安全漏洞 — defu 7.5 High2026-04-06
CVE-2026-2950 lodash 安全漏洞 — lodash 6.5 Medium2026-03-31
CVE-2026-34221 MikroORM 安全漏洞 — mikro-orm 8.2AIHighAI2026-03-31
CVE-2026-33994 Locutus 安全漏洞 — locutus 9.8 -2026-03-27
CVE-2026-33993 Locutus 安全漏洞 — locutus 9.8 -2026-03-27
CVE-2026-33672 Picomatch 安全漏洞 — picomatch 5.3 Medium2026-03-26
CVE-2026-33696 n8n 安全漏洞 — n8n 8.8 -2026-03-25
CVE-2026-33228 flatted 安全漏洞 — flatted 9.1 -2026-03-20
CVE-2026-32886 Parse Server 安全漏洞 — parse-server 7.5 -2026-03-18

CWE-1321 是常见的弱点类别，本平台收录该类弱点关联的 152 条 CVE 漏洞。