目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-1321 类漏洞列表 261

CWE-1321 类弱点 261 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1321 原型污染漏洞属于对象属性控制不当类型。攻击者通过注入恶意输入，修改 JavaScript 对象的原型属性，从而污染全局对象或影响后续实例。这可能导致远程代码执行、拒绝服务或权限提升。开发者应避免直接合并用户输入，使用 Object.create(null) 创建无原型对象，或采用安全库限制原型修改，并严格验证输入来源，以阻断污染路径。

MITRE CWE 官方描述
CWE：CWE-1321 对象原型属性（'Prototype Pollution'）的修改控制不当 英文：产品接收来自上游组件的输入，该输入指定了要在对象中初始化或更新的属性，但它未能正确控制对对象原型（prototype）属性的修改。
常见影响 (2)
Confidentiality, Integrity, Availability Read Application Data, Modify Application Data
This weakness is usually exploited by using a special attribute of objects called proto, constructor, or prototype. Such attributes give access to the object prototype. An attacker can inject attributes that are used in other components by adding or modifying attributes of an object prototype. This …
Availability DoS: Crash, Exit, or Restart
An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
缓解措施 (5)
Implementation By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Effectiveness: High
Architecture and Design By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Effectiveness: High
Implementation When handling untrusted objects, validating using a schema can be used.
Effectiveness: Limited
Implementation By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Effectiveness: High
Implementation Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
Effectiveness: Moderate
代码示例 (1)
This function sets object attributes based on a dot-separated path.
function setValueByPath (object, path, value) { const pathArray = path.split("."); const attributeToSet = pathArray.pop(); let objectToModify = object; for (const attr of pathArray) { if (typeof objectToModify[attr] !== 'object') { objectToModify[attr] = {}; } objectToModify = objectToModify[attr]; } objectToModify[attributeToSet] = value; return object; }
Bad · JavaScript
setValueByPath({}, "__proto__.isAdmin", true) setValueByPath({}, "constructor.prototype.isAdmin", true)
Bad · JavaScript
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-27212 Swiper 安全漏洞 — swiper 9.8AI Critical AI 2026-02-21
CVE-2026-26021 set-in 安全漏洞 — set-in 9.8AI Critical AI 2026-02-11
CVE-2026-25881 SandboxJS 安全漏洞 — SandboxJS 9.1 Critical 2026-02-09
CVE-2026-25754 @adonisjs/lucid 安全漏洞 — core 7.2 High 2026-02-06
CVE-2026-25521 Locutus 安全漏洞 — locutus 9.8 - 2026-02-04
CVE-2026-25150 Qwik 安全漏洞 — qwik 9.3 Critical 2026-02-03
CVE-2026-25047 deepHas 安全漏洞 — deepHas 5.3AI Medium AI 2026-01-29
CVE-2026-24888 Maker.js 安全漏洞 — maker.js 6.5 Medium 2026-01-28
CVE-2026-24766 NocoDB 安全漏洞 — nocodb 4.9 Medium 2026-01-28
CVE-2026-23736 seroval 安全漏洞 — seroval 7.3 High 2026-01-21
CVE-2025-13465 lodash 安全漏洞 — lodash 6.9 Medium 2026-01-21
CVE-2024-14020 carbone 安全漏洞 — carbone 5.0 Medium 2026-01-07
CVE-2025-13158 apidoc-core 安全漏洞 — apidoc-core 9.8 - 2025-12-26
CVE-2025-68130 tRPC 安全漏洞 — trpc 9.8AI Critical AI 2025-12-16
CVE-2025-8083 vuetify 安全漏洞 — Vuetify 8.6 High 2025-12-12
CVE-2025-66456 elysia 安全漏洞 — elysia 9.8AI Critical AI 2025-12-09
CVE-2025-64718 JS-YAML 安全漏洞 — js-yaml 5.3 Medium 2025-11-13
CVE-2025-62517 Rollbar.js 安全漏洞 — rollbar.js 5.9 Medium 2025-10-23
CVE-2025-62410 happy-dom 安全漏洞 — happy-dom 10.0 - 2025-10-15
CVE-2025-62381 SvelteKit 安全漏洞 — sveltekit-superforms 9.8AI Critical AI 2025-10-15
CVE-2025-62374 Parse-SDK-JS 安全漏洞 — Parse-SDK-JS 6.4 Medium 2025-10-14
CVE-2025-3193 algoliasearch-helper 安全漏洞 — algoliasearch-helper 7.5 High 2025-09-27
CVE-2025-58280 Huawei HarmonyOS 安全漏洞 — HarmonyOS 8.4 High 2025-09-05
CVE-2025-57820 Svelte 安全漏洞 — devalue 9.1AI Critical AI 2025-08-26
CVE-2025-55195 Deno Standard Library 安全漏洞 — std 7.3 High 2025-08-14
CVE-2025-55164 Content Security Policy parser 安全漏洞 — content-security-policy-parser 9.8AI Critical AI 2025-08-12
CVE-2025-54803 js-toml 安全漏洞 — js-toml 9.8AI Critical AI 2025-08-05
CVE-2025-34146 SandboxJS 安全漏洞 — sandboxjs 7.0 High 2025-07-31
CVE-2025-8101 Linkify 安全漏洞 — Linkify 6.1 - 2025-07-25
CVE-2025-49223 billboard.js 安全漏洞 — billboard.js 9.8AI Critical AI 2025-06-04

CWE-1321 是常见的弱点类别，本平台收录该类弱点关联的 261 条 CVE 漏洞。