目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-1321 类漏洞列表 261

CWE-1321 类弱点 261 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1321 原型污染漏洞属于对象属性控制不当类型。攻击者通过注入恶意输入，修改 JavaScript 对象的原型属性，从而污染全局对象或影响后续实例。这可能导致远程代码执行、拒绝服务或权限提升。开发者应避免直接合并用户输入，使用 Object.create(null) 创建无原型对象，或采用安全库限制原型修改，并严格验证输入来源，以阻断污染路径。

MITRE CWE 官方描述
CWE：CWE-1321 对象原型属性（'Prototype Pollution'）的修改控制不当 英文：产品接收来自上游组件的输入，该输入指定了要在对象中初始化或更新的属性，但它未能正确控制对对象原型（prototype）属性的修改。
常见影响 (2)
Confidentiality, Integrity, Availability Read Application Data, Modify Application Data
This weakness is usually exploited by using a special attribute of objects called proto, constructor, or prototype. Such attributes give access to the object prototype. An attacker can inject attributes that are used in other components by adding or modifying attributes of an object prototype. This …
Availability DoS: Crash, Exit, or Restart
An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
缓解措施 (5)
Implementation By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Effectiveness: High
Architecture and Design By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Effectiveness: High
Implementation When handling untrusted objects, validating using a schema can be used.
Effectiveness: Limited
Implementation By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Effectiveness: High
Implementation Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Effectiveness: Moderate
代码示例 (1)
This function sets object attributes based on a dot-separated path.
function setValueByPath (object, path, value) { const pathArray = path.split("."); const attributeToSet = pathArray.pop(); let objectToModify = object; for (const attr of pathArray) { if (typeof objectToModify[attr] !== 'object') { objectToModify[attr] = {}; } objectToModify = objectToModify[attr]; } objectToModify[attributeToSet] = value; return object; }
Bad · JavaScript
setValueByPath({}, "__proto__.isAdmin", true) setValueByPath({}, "constructor.prototype.isAdmin", true)
Bad · JavaScript
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-15187 Enquirer 输入验证错误漏洞 — enquirer 4.3 Medium 2026-07-09
CVE-2026-59876 protobufjs protobuf.js 输入验证错误漏洞 — protobuf.js 4.8 Medium 2026-07-08
CVE-2026-54756 Valerii jodit 输入验证错误漏洞 — jodit - - 2026-07-01
CVE-2026-55886 xdsoft Jodit Editor 输入验证错误漏洞 — jodit - - 2026-07-01
CVE-2026-57926 JetBrains YouTrack 输入验证错误漏洞 — YouTrack 2.6 Low 2026-06-26
CVE-2026-54639 Style Dictionary 输入验证错误漏洞 — style-dictionary 8.8 High 2026-06-24
CVE-2026-44791 n8n 输入验证错误漏洞 — n8n - - 2026-06-23
CVE-2026-44789 n8n-io n8n 输入验证错误漏洞 — n8n - - 2026-06-23
CVE-2026-54306 n8n 输入验证错误漏洞 — n8n - - 2026-06-23
CVE-2026-54312 n8n 输入验证错误漏洞 — n8n - - 2026-06-23
CVE-2026-49252 DeepstreamIO 输入验证错误漏洞 — deepstream.io 9.9 Critical 2026-06-18
CVE-2026-53676 ThingsBoard 输入验证错误漏洞 — ThingsBoard - - 2026-06-17
CVE-2026-48714 i18next i18next-http-middleware 输入验证错误漏洞 — i18next-http-middleware 9.1 Critical 2026-06-15
CVE-2026-48713 i18next i18next-fs-backend 输入验证错误漏洞 — i18next-fs-backend 9.1 Critical 2026-06-15
CVE-2026-12209 rubylouvre avalon 输入验证错误漏洞 — avalon 5.3 Medium 2026-06-15
CVE-2026-12208 jsonata-js jsonata 输入验证错误漏洞 — jsonata 5.3 Medium 2026-06-15
CVE-2026-53609 ApostropheCMS 输入验证错误漏洞 — apostrophe 9.1 Critical 2026-06-12
CVE-2026-44490 Axios 安全漏洞 — axios 4.8 Medium 2026-06-11
CVE-2026-46625 JavaScript Cookie 安全漏洞 — js-cookie 7.5 High 2026-06-10
CVE-2026-45302 parse-nested-form-data 安全漏洞 — parse-nested-form-data 8.2 High 2026-06-01
CVE-2026-46510 form-data-objectizer 安全漏洞 — form-data-objectizer 8.2 High 2026-05-29
CVE-2026-46509 deepobj 安全漏洞 — deepobj 8.2 High 2026-05-28
CVE-2026-44483 RVF 安全漏洞 — rvf 8.2 High 2026-05-27
CVE-2026-44966 Velocity.js 安全漏洞 — velocity.js 8.3 High 2026-05-26
CVE-2026-9101 MongoDB Compass 安全漏洞 — Compass 4.3 Medium 2026-05-20
CVE-2026-8657 jsondiffpatch 安全漏洞 — jsondiffpatch 8.2 High 2026-05-16
CVE-2026-44005 vm2 代码注入漏洞 — vm2 10.0 Critical 2026-05-13
CVE-2026-44292 protobuf.js 安全漏洞 — protobuf.js 5.3 Medium 2026-05-13
CVE-2026-44290 protobuf.js 安全漏洞 — protobuf.js 7.5 High 2026-05-13
CVE-2026-42264 Axios 安全漏洞 — axios 7.4 High 2026-05-08

CWE-1321 是常见的弱点类别，本平台收录该类弱点关联的 261 条 CVE 漏洞。