Prototype Pollution

Records the NVD classes as Prototype Pollution (CWE-1321), highest CVSS first.

1. MEDIUM 6.5CVE-2026-14574public PoC2026-08-05

   In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructor`, `prototype`). Because this function …

   theia

   AI risk analysis on Exploit-DB.ai →

2. MEDIUM 4.3CVE-2026-97724public PoC2026-09-25

   A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject in packages…

   AI risk analysis on Exploit-DB.ai →

3. MEDIUM 4.3CVE-2026-61834public PoC2026-09-23

   scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys b…

   AI risk analysis on Exploit-DB.ai →

4. LOW 3.7CVE-2026-69200public PoC2026-09-16

   node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allo…

   AI risk analysis on Exploit-DB.ai →

5. UNSCOREDCVE-2026-101909public PoC2026-09-28

   Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process protot…

   AI risk analysis on Exploit-DB.ai →

6. UNSCOREDCVE-2026-101908public PoC2026-09-28

   Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution fl…

   AI risk analysis on Exploit-DB.ai →

7. UNSCOREDCVE-2026-101905public PoC2026-09-28

   Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a …

   AI risk analysis on Exploit-DB.ai →

8. UNSCOREDCVE-2026-101904public PoC2026-09-28

   Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw set…

   AI risk analysis on Exploit-DB.ai →

9. UNSCOREDCVE-2026-101902public PoC2026-09-28

   Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same p…

   AI risk analysis on Exploit-DB.ai →

10. UNSCOREDCVE-2026-101900public PoC2026-09-28

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw s…

    AI risk analysis on Exploit-DB.ai →

11. UNSCOREDCVE-2026-97151public PoC2026-09-24

    mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, application…

    AI risk analysis on Exploit-DB.ai →