This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077

All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.

All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend.

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

All versions of package safetydance are vulnerable to Prototype Pollution via the set function.

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.

The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.

All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.

All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.

All versions of phpjs are vulnerable to Prototype Pollution via parse_str.

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.

All versions of package deeps are vulnerable to Prototype Pollution via the set function.

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.

The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.

All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.

This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.

All versions of package gedi are vulnerable to Prototype Pollution via the set function.

madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload.

The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.

The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.

All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.

All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.

All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.

This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.

All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.

An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().

In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.

Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.

The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.

vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.

Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js.

Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.