CWE-1321 · Deserialization and Object Injection
Prototype Pollution
589CVEs
1exploited
4with a public check
11likely (EPSS 10%+)
SortMost likely exploited
589 CVEs with CWE-1321 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-34621In CISA KEVExploitedAcrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)Adobe · Acrobat DC · CVSS 8.6 · 2026-04-11 | 8.6 | 7.3% | 2026-04-11 |
| CVE-2019-0230CheckApache Struts <=2.5.20 - Remote Code ExecutionApache · Apache Struts · 2020-09-14 | – | 97% | 2020-09-14 |
| CVE-2021-20086CheckOdoo Apps - Cross-Site Scripting via Prototype PollutionJquery-Bbq Project · jquery-bbq · 2021-04-23 | – | 6.1% | 2021-04-23 |
| CVE-2021-41097CheckAurelia-Path < 1.1.7 - Prototype Pollutionaurelia · path · CVSS 9.1 · 2021-09-27 | 9.1 | 4.9% | 2021-09-27 |
| CVE-2022-0432CheckMastodon Prototype Pollution Vulnerabilitymastodon · mastodon/mastodon · CVSS 7.4 · 2022-02-02 | 7.4 | 4.4% | 2022-02-02 |
| CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source o…Jquery · Jquery · 2019-04-19 | – | 87% | 2019-04-19 |
| CVE-2020-7774Prototype PollutionY18n Project · y18n · CVSS 7.3 · 2020-11-17 | 7.3 | 70% | 2020-11-17 |
| CVE-2022-39396Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parserparse-community · parse-server · CVSS 9.8 · 2022-11-10 | 9.8 | 39% | 2022-11-10 |
| CVE-2022-2564Prototype Pollution in automattic/mongooseautomattic · automattic/mongoose · CVSS 7 · 2022-07-28 | 7.0 | 31% | 2022-07-28 |
| CVE-2021-23450Prototype PollutionLinuxfoundation · dojo · CVSS 7.5 · 2021-12-17 | 7.5 | 30% | 2021-12-17 |
| CVE-2022-1802If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code…Mozilla · Firefox ESR · CVSS 8.8 · 2022-12-22 | 8.8 | 28% | 2022-12-22 |
| CVE-2022-2200If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulne…Mozilla · Firefox · CVSS 8.8 · 2022-12-22 | 8.8 | 24% | 2022-12-22 |
| CVE-2025-25014Kibana arbitrary code execution via prototype pollutionElastic · Kibana · CVSS 9.1 · 2025-05-06 | 9.1 | 22% | 2025-05-06 |
| CVE-2022-1529An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately at…Mozilla · Firefox ESR · CVSS 8.8 · 2022-12-22 | 8.8 | 18% | 2022-12-22 |
| CVE-2022-24999qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be us…Qs Project · Qs · CVSS 7.5 · 2022-11-26 | 7.5 | 16% | 2022-11-26 |
| CVE-2019-16328In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default co…Rpyc Project · Rpyc · 2019-10-03 | – | 13% | 2019-10-03 |
| CVE-2022-46175JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before…json5 · json5 · CVSS 7.1 · 2022-12-24 | 7.1 | 9.7% | 2022-12-24 |
| CVE-2019-14379SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransaction…Fasterxml · Jackson-Databind · 2019-07-29 | – | 8.0% | 2019-07-29 |
| CVE-2019-19919Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ proper…Handlebars.js Project · Handlebars.js · 2019-12-20 | – | 7.1% | 2019-12-20 |
| CVE-2019-10744Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype usi…Snyk · lodash · 2019-07-25 | – | 5.0% | 2019-07-25 |
| CVE-2020-7699Prototype PollutionExpress-Fileupload Project · express-fileupload · CVSS 7.5 · 2020-07-30 | 7.5 | 4.8% | 2020-07-30 |
| CVE-2020-7746Prototype PollutionChartjs · chart.js · CVSS 7.5 · 2020-10-29 | 7.5 | 4.7% | 2020-10-29 |
| CVE-2021-44906Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).Substack · Minimist · 2022-03-17 | – | 4.6% | 2022-03-17 |
| CVE-2021-23383Prototype PollutionHandlebarsjs · handlebars · CVSS 5.6 · 2021-05-04 | 5.6 | 4.5% | 2021-05-04 |
| CVE-2021-25913Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.Set-Or-Get Project · set-or-get · 2021-02-08 | – | 4.4% | 2021-02-08 |
| CVE-2021-20083Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Obj…Jquery-Plugin-Query-Object Project · jquery-plugin-query-object · 2021-04-23 | – | 4.2% | 2021-04-23 |
| CVE-2020-28269Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.Exodus · field · 2020-11-12 | – | 4.2% | 2020-11-12 |
| CVE-2020-7768Prototype PollutionGrpc · grpc · CVSS 7.5 · 2020-11-11 | 7.5 | 4.0% | 2020-11-11 |
| CVE-2022-21190Prototype PollutionMozilla · convict · CVSS 7.5 · 2022-05-13 | 7.5 | 4.0% | 2022-05-13 |
| CVE-2020-7743Prototype PollutionMathjs · mathjs · CVSS 7.3 · 2020-10-13 | 7.3 | 3.9% | 2020-10-13 |
| CVE-2020-28270Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.Mjpclab · object-hierarchy-access · 2020-11-12 | – | 3.8% | 2020-11-12 |
| CVE-2021-3918Prototype Pollution in kriszyp/json-schemakriszyp · kriszyp/json-schema · CVSS 9.8 · 2021-11-13 | 9.8 | 3.8% | 2021-11-13 |
| CVE-2021-23497Prototype PollutionSet Project · @strikeentco/set · CVSS 7.5 · 2022-02-04 | 7.5 | 3.7% | 2022-02-04 |
| CVE-2018-6195admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author)…Splashing Images Project · Splashing Images · 2018-01-30 | – | 3.7% | 2018-01-30 |
| CVE-2020-28458Prototype PollutionDatatables · datatables.net · CVSS 7.3 · 2020-12-16 | 7.3 | 3.7% | 2020-12-16 |
| CVE-2021-25914Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.Fireblink · object-collider · CVSS 9.8 · 2021-03-01 | 9.8 | 3.7% | 2021-03-01 |
| CVE-2020-7788Prototype PollutionIni Project · ini · CVSS 7.3 · 2020-12-11 | 7.3 | 3.7% | 2020-12-11 |
| CVE-2021-23449Sandbox BypassVm2 Project · vm2 · CVSS 9.8 · 2021-10-18 | 9.8 | 3.6% | 2021-10-18 |
| CVE-2020-28268Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.Controlled-Merge Project · controlled-merge · 2020-11-15 | – | 3.6% | 2020-11-15 |
| CVE-2021-25916Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.Patchmerge Project · patchmerge · CVSS 9.8 · 2021-03-16 | 9.8 | 3.5% | 2021-03-16 |
| CVE-2021-25915Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution.Changeset Project · changeset · CVSS 9.8 · 2021-03-09 | 9.8 | 3.5% | 2021-03-09 |
| CVE-2022-37601Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1…Webpack.js · Loader-Utils · 2022-10-12 | – | 3.5% | 2022-10-12 |
| CVE-2021-25912Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution.Dotty Project · dotty · 2021-02-02 | – | 3.5% | 2021-02-02 |
| CVE-2020-28271Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.Sharpred · deephas · 2020-11-12 | – | 3.4% | 2020-11-12 |
| CVE-2021-25928Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.Manta · safe-obj · CVSS 9.8 · 2021-04-26 | 9.8 | 3.4% | 2021-04-26 |
| CVE-2020-7707Prototype PollutionProperty-Expr Project · property-expr · CVSS 9.8 · 2020-08-18 | 9.8 | 3.4% | 2020-08-18 |
| CVE-2021-43138In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollutio…Async Project · Async · 2022-04-06 | – | 3.3% | 2022-04-06 |
| CVE-2021-25952Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.Just-Safe-Set Project · just-safe-set · 2021-07-07 | – | 3.3% | 2021-07-07 |
| CVE-2021-25941Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.Deep-Override Project · deep-override · CVSS 9.8 · 2021-05-14 | 9.8 | 3.3% | 2021-05-14 |
| CVE-2021-25927Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.Safe-Flat Project · safe-flat · CVSS 9.8 · 2021-04-26 | 9.8 | 3.3% | 2021-04-26 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.