By weakness (CWE)

CWE-1321: related vulnerabilities

CVEs classified under CWE-1321. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

21 published vulnerabilities

• CVE-2026-54639HIGH 8.8

  Style Dictionary, a widely-used build tool for managing design tokens across platforms, contains a prototype pollution vulnerability that allows attackers to inject malicious properties into JavaScript objects through specially crafted token data. The flaw affects versions 4.3.0 through 5.4.3 and is particularly dangerous when Style Dictionary processes tokens in server-side Node.js applications, where an attacker with the ability to modify token inputs could corrupt application state or behavior. Organizations using this library should update to version 5.4.4 or later immediately if they process untrusted or externally-sourced token data.

• CVE-2026-44494HIGH 8.7

  Axios, a widely-used HTTP client library for JavaScript applications, contains a vulnerability that allows attackers to intercept and modify all network traffic from an affected application. An attacker who can pollute an application's prototype chain (through a separate vulnerability in a dependency) can inject a malicious proxy configuration into Axios. Once injected, Axios will route all HTTP requests—including those carrying authentication credentials—through the attacker's proxy server, enabling complete man-in-the-middle attacks. This affects Axios versions 1.0.0 through 1.15.x; upgrading to 1.16.0 or later eliminates the vulnerability.

• CVE-2026-54312HIGH 8.5

  n8n, a popular open source workflow automation platform, contains a prototype pollution vulnerability in its Microsoft SQL node that allows authenticated users to corrupt the JavaScript prototype chain across the entire application. When a user with permission to create or modify workflows supplies a malicious value in the table parameter, it permanently poisons Object.prototype for the running process, breaking validation logic application-wide and rendering the n8n instance unusable until restart. The vulnerability affects versions before 2.24.0 and requires an authenticated account but no additional user interaction.

• CVE-2026-45302HIGH 8.2

  parse-nested-form-data is a Node.js library that converts web form submissions into structured JavaScript objects and arrays. Versions before 1.0.1 contain a prototype pollution vulnerability: if an attacker submits a form field with a name like `__proto__` or containing `.__proto__.` anywhere in it, the parser inadvertently modifies JavaScript's Object.prototype. This pollutes the prototype chain for every plain object created in the application afterward, potentially corrupting application logic, exposing sensitive data, or enabling denial of service.

• CVE-2026-46509HIGH 8.2

  The deepobj library contains a prototype pollution vulnerability that allows attackers to manipulate JavaScript object prototypes through specially crafted property paths. When an application uses deepobj to get, set, or delete nested object properties—and exposes the property path to attacker input—an attacker can inject payloads using __proto__, constructor, or prototype keywords to corrupt the prototype chain. This can lead to unexpected behavior, denial of service, or in certain contexts, code execution. The vulnerability was resolved in version 1.0.3.

• CVE-2026-46510HIGH 8.2

  form-data-objectizer is a Node.js library that converts HTML form data into JavaScript objects. Versions prior to 1.0.1 contain a prototype pollution vulnerability. An attacker can craft an HTTP form submission with a specially-named field (beginning with __proto__) that causes the library to overwrite Object.prototype—the base template all JavaScript objects inherit from. This single malicious form field corrupts the entire Node.js process, allowing an attacker to inject arbitrary properties into all objects, potentially leading to authentication bypass, data manipulation, or application crashes.

• CVE-2026-55388HIGH 8.1

  Piscina is a Node.js library that manages worker threads—a way to run code in parallel without blocking the main application. A vulnerability in how piscina handles configuration allows an attacker to inject malicious code by polluting JavaScript's Object.prototype, a shared object that all objects inherit from. When an attacker taints Object.prototype.filename before piscina tries to load a worker script, piscina will unknowingly use the attacker's malicious file path instead of the intended one, executing arbitrary code with the privileges of the worker thread. The vulnerability affects versions before 6.0.0-rc.2, 5.2.0, and 4.9.3.

• CVE-2026-46625HIGH 7.5

  js-cookie is a popular JavaScript library that manages browser cookies. Versions before 3.0.7 contain a prototype pollution vulnerability where an attacker can manipulate cookie security attributes. By crafting a malicious JSON object with a specially-formed __proto__ property, an attacker can inject unauthorized cookie attributes like domain, secure, samesite, expires, and path. This allows them to broaden cookie scope, remove security restrictions, or extend cookie lifetime—potentially enabling session hijacking, cross-site request forgery, or credential theft depending on how the application uses cookies.

• CVE-2026-53676HIGH 7.2

  ThingsBoard, an IoT platform, contains a prototype pollution vulnerability that allows authenticated tenant administrators to execute arbitrary code in a restricted sandboxed environment. While the code execution occurs within a sandbox that limits its reach, an attacker with admin credentials could use this flaw to manipulate application behavior, bypass security controls, or potentially escalate privileges. The vulnerability requires valid login credentials with tenant administrator role—it is not remotely exploitable without prior authentication.

• CVE-2026-59206HIGH 7.1

  n8n, an open source workflow automation platform, contains a prototype pollution vulnerability that allows authenticated users with basic workflow creation permissions to corrupt the platform's core object model. By crafting and saving a malicious workflow, an attacker can manipulate how the application handles object properties globally, effectively tricking the system into treating unauthenticated requests as if they came from a privileged user. This bypass exposes sensitive endpoints that list users and projects, compromising confidentiality and potentially enabling further reconnaissance for lateral movement.

• CVE-2026-44495HIGH 7.0

  Axios, a widely-used HTTP client library for JavaScript applications, contains prototype-pollution gadgets that can be exploited if another vulnerability in the same process has already poisoned JavaScript's Object.prototype. The issue affects versions 0.19.0 through 0.31.0 in the 0.x branch and version 1.15.1 in the 1.x branch. By itself, Axios does not cause the initial prototype pollution; instead, it becomes a secondary target once an attacker has already compromised Object.prototype through a separate vulnerability. When this occurs, Axios may incorrectly interpret inherited properties as legitimate request configuration, leading to potential code execution or data exposure. The vulnerability is addressed in Axios 0.31.1 and 1.15.2.

• CVE-2026-54306MEDIUM 6.4

  n8n, a popular open-source workflow automation platform, contains a prototype pollution vulnerability that allows attackers to inject malicious data through public webhooks. If a workflow accepts external webhook input and uses that data in action nodes—such as updating records or making API calls—an attacker can manipulate those downstream actions by poisoning the data stream. The attacker essentially tricks the workflow into performing unintended operations, like modifying the wrong records or sending requests using the workflow owner's credentials. This flaw affects versions before 2.25.7 and 2.26.2.

• CVE-2026-15195MEDIUM 6.3

  A prototype pollution vulnerability has been identified in the apidevtools json-schema-ref-parser library (versions up to 15.3.5). The flaw allows authenticated attackers to improperly modify object prototype attributes through the Refs.set and Pointer.set functions. This can be exploited remotely and may lead to unauthorized data modification or application behavior changes. Upgrading to version 15.3.6 resolves the issue.

• CVE-2026-12208MEDIUM 5.3

  A prototype pollution vulnerability exists in jsonata-js (jsonata library) versions up to 2.2.0. The vulnerability is in the createFrame function within the Function Binding Frame System, allowing attackers to remotely modify object prototype attributes. An exploit has been publicly disclosed, increasing the risk of widespread exploitation. The vendor has not responded to early disclosure attempts.

• CVE-2026-12209MEDIUM 5.3

  RubyLouvre avalon, a popular Ruby templating library, contains a vulnerability in its filter handling mechanism that allows attackers to manipulate JavaScript object prototypes remotely. An attacker can inject malicious code through the template filter system to alter core object properties, potentially affecting application behavior across an entire system. The vulnerability requires no special privileges or user interaction to exploit, making it straightforward to weaponize. Public exploit code is already available, and the vendor has not responded to early disclosure attempts.

• CVE-2026-57439MEDIUM 5.0

  CyberChef, a popular web application for data encryption, encoding, and analysis, contains a vulnerability in its Series Chart operation that allows an attacker to inject malicious code. By crafting a specially formatted CSV file with a `__proto__` key, an attacker can exploit prototype pollution—a JavaScript technique that modifies object prototypes—to insert harmful JavaScript that gets executed when the data is rendered in HTML. This requires user interaction (opening/uploading a file) but can compromise the security of the application and potentially affect downstream operations like UDP packet parsing.

• CVE-2026-44490MEDIUM 4.8

  Axios, a widely-used HTTP client for JavaScript environments, contains two prototype-pollution vulnerabilities that can be exploited when an upstream dependency (such as lodash) has already polluted JavaScript's Object.prototype. An attacker cannot directly trigger these gadgets, but if your application uses a vulnerable dependency alongside axios, malicious code or data flowing through your supply chain could cause axios to either leak polluted properties in HTTP headers or crash on every request with a TypeError. Versions before 0.32.0 (for the 0.x line) and before 1.16.0 (for the 1.x line) are affected.

• CVE-2026-59876MEDIUM 4.8

  protobufjs is a popular library that converts Protocol Buffer definitions into JavaScript functions for serialization and deserialization. Between versions 8.2.0 and 8.6.4, the Text Format extension (which parses human-readable protobuf text) contained a prototype pollution vulnerability. When processing map entries, the code would assign user-supplied keys directly to the map object using standard property assignment. An attacker who controls protobuf text input could inject a key named `__proto__` to modify the prototype chain of the resulting map object, potentially affecting how the application behaves with that object and related instances. This is a moderate-severity issue that requires specific attack conditions to exploit but can lead to unexpected property access or behavior changes.

• CVE-2026-15187MEDIUM 4.3

  A prototype pollution vulnerability exists in enquirer, a Node.js package for interactive command-line prompts, affecting versions up to 2.4.1. The flaw allows an authenticated attacker to manipulate object prototypes through the question.name parameter when using the Enquirer.set method, potentially modifying application behavior. The vulnerability requires authenticated access and does not directly expose sensitive data, but could enable privilege escalation or unintended state changes within applications that rely on enquirer. Public exploit code is available.

• CVE-2026-44489LOW 3.7

  Axios, a widely-used HTTP client library for JavaScript, contains a prototype pollution vulnerability in its configuration merging logic. When a developer uses Axios with a proxy configuration, an attacker can pollute the Object.prototype to inject fake username and password values. These polluted values are then automatically included in Proxy-Authorization headers sent with every proxied HTTP request, potentially leaking attacker-controlled credentials or disrupting authentication. The vulnerability affects Axios versions 1.15.2 through 1.15.x and is resolved in version 1.16.0.

• CVE-2026-57926LOW 2.6

  JetBrains YouTrack versions before 2026.2.16593 contain a prototype pollution vulnerability in the websandbox bridge component. An authenticated user with user-interaction involvement could exploit this flaw to modify object properties, potentially leading to limited integrity compromise. The vulnerability has a low CVSS score of 2.6, reflecting its narrow attack surface and minimal impact.