Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A plain object `{}` is used as a dictionary map for objects from an array, with a key derived directly from the object's properties. If the key is controlled by an attacker (e.g., `__proto__`), this can lead to Prototype Pollution. Use `Object.create(null)` to safely store items without inheriting from `Object.prototype`.
Detected an unvalidated queue traversal using user-controlled array keys (e.g., via `shift()` or `pop()`). Assigning or dynamically navigating an object using unvalidated parts of a path leaves it vulnerable to Prototype Pollution. Always validate path segments against a denylist (e.g. `['__proto__', 'constructor', 'prototype']`).
Checking property existence with the `in` operator can lead to prototype pollution when dealing with user-controlled keys. The `in` operator traverses the prototype chain and evaluates to true for internal properties like `__proto__` and `constructor`. If the property is then extracted and modified, it can pollute the global object prototype. Replace `in` wi
Cloning objects with `Object.assign({}, ...)` can lead to local prototype pollution if an input argument contains a malicious `__proto__` property (such as from parsed JSON). `Object.assign` invokes the `__proto__` setter on the new empty target object, altering its prototype chain. When this cloned object is subsequently merged, iterated via `for...in`, or
Using `RegExp.prototype.test` against a regex containing `__proto__`, `constructor`, or `prototype` as a prototype-pollution guard is bypassable. `RegExp.prototype.test` is a writable prototype method; an attacker that can override it (via another gadget in the same realm) can force the guard to return `false` and re-enable `Object.prototype` pollution throu
A String wrapper instance is used directly as an Array index without numeric coercion. Array property access for non-numeric string keys traverses the prototype chain, so an attacker-controlled value such as "__proto__" resolves to Array.prototype, leaking a live reference that enables prototype pollution (CWE-1321). Coerce the value with `+value` or validat
Possible prototype pollution (CWE-1321): assigning into a target object using a key obtained from another object's keys (Object.keys(...) or for..in) without first ensuring the property is an own property of the target. If the key is an inheritable name (e.g. `__proto__`, `constructor`, `prototype`, `toString`), the bracket-notation write traverses the proto
Iteration callback writes `$OBJ[$K] = $V` to a plain object without filtering prototype-polluting keys (e.g. '__proto__', 'constructor'). When the iterated collection's keys are attacker-controlled (e.g. an Immutable.Map built from `fromJS(JSON.parse(input))`), this triggers the prototype setter and pollutes the returned object's prototype (CVE-2026-29063, C
Using `Array.prototype.includes()` to guard against prototype-pollution keys ('__proto__', 'constructor', 'prototype') is bypassable. An attacker who can execute JavaScript in the same realm before this guard runs can shadow `Array.prototype.includes` (e.g., `Array.prototype.includes = () => false`), causing the check to silently pass and allowing the forbid
A recursive merge/assign callback writes to `result[key]` (and may recurse via a deep-merge call) without filtering the dangerous property names "__proto__", "constructor", and "prototype". When the source object is attacker-influenced (e.g., parsed JSON used as request config), iterating its keys and assigning them onto a fresh object pollutes Object.protot
Calling `.hasOwnProperty()` as an instance method in a function-property mutation guard is unsafe in sandbox or access-control code. When the guarded object is itself a prototype (e.g., `Map.prototype`), its built-in methods ARE own properties. As a result, `!obj.hasOwnProperty(prop)` evaluates to `false` and the guard silently permits the overwrite. This al
Calling hasOwnProperty() as a direct instance method on an object can be defeated by an attacker who supplies an object with a shadowed hasOwnProperty (e.g., { hasOwnProperty: () => true }). In sandbox or security-boundary code this causes prototype-access guards to silently pass, enabling host Object.prototype pollution. Use Object.prototype.hasOwnProperty.
Authentication compares a bracket-indexed object lookup (e.g. users[username]) to a value using loose equality (==). When the bracket key originates from untrusted input, an attacker can pass "__proto__" so the lookup returns Object.prototype, which is truthy and is coerced by == to "[object Object]" — matching a chosen password and bypassing authentication.
An incomplete blocklist was used to filter object keys. Filtering properties like `__proto__` and `constructor` but failing to filter essential `Object.prototype` properties like `toString`, `valueOf`, and `hasOwnProperty` can lead to application crashes (DoS) when overridden properties are unexpectedly executed. Consider validating against an extensive list
Walking a dot-notation path via Array.reduce and assigning each segment as an object property (`$RES[$PROP] = $RES[$PROP] || {}`) without filtering `__proto__`, `constructor`, or `prototype` enables prototype pollution (CWE-1321). When the path is attacker-controllable (e.g., rule condition keys, JSON config, query parameters) a value such as `__proto__.x` w
The dchester/jsonpath library uses JSONPath components as object keys in its write-capable / traversal methods (value, apply, parent, _vivify, nodes, _normalize) without rejecting prototype-chain keys such as `__proto__`, `prototype`, or `constructor`. In versions < 1.2.0 this allows prototype pollution (CVE-2025-61140, CWE-1321) when path strings are influe
Exposing the raw global `Object` alongside other built-ins often indicates an evaluation context or sandbox creation. Passing the raw `Object` allows attackers to access reflection and prototype manipulation methods (e.g., `Object.getPrototypeOf`, `Object.getOwnPropertyDescriptor`). This can lead to sandbox escape, arbitrary code execution, or prototype poll
Reading a property from a plain object with a non-literal key and a `|| {}` fallback, then writing into the resulting object via bracket notation, enables prototype pollution (CWE-1321; see CVE-2025-25977). If the key evaluates to "__proto__", the lookup resolves to Object.prototype (not undefined), and the subsequent `props[name] = value` writes onto the gl
A key iteration loop attempts to prevent prototype pollution by blocking the '__proto__' key but fails to block the 'constructor' key. This allows attackers to execute Prototype Pollution attacks by injecting 'constructor.prototype' changes, which may lead to arbitrary code execution or logic bypass.
Recursive deep-merge iterates source-object keys with `for...in` and assigns to `base[key]` by recursing into `base[key]` itself (`base[key] = merge(base[key], value)`) without filtering the dangerous keys `__proto__`, `constructor`, or `prototype`. If any source object is derived from attacker-controlled input (e.g., JSON.parse of a request body), reading `
`for...in` loop is guarded only by an own-property check (`hasProp`/`hasOwnProperty`) without filtering the dangerous keys `__proto__` and `constructor`. When the loop body forwards `prop` into a recursive merge or assignment on another object (a common pattern in `mixin`/`extend`/`configure` helpers), an attacker who can supply the iterated object via `JSON
Detected a loop traversing object properties using user-controlled deep assignments without prototype pollution protections. Using `obj[key] ?? fallback` allows traversing out into `Object.prototype`, which can enable attackers to blindly pollute the global object. Use `Object.hasOwn(obj, key)` before accessing or assigning nested arbitrary properties.
A custom iteration over `Object.keys()` is used to access or assign to another object without explicitly filtering out dangerous keys like `__proto__`, `constructor`, or `prototype`. This pattern is typically found in vulnerable merge routines and can lead to Prototype Pollution.
The key `$K` is extracted from an array and checked against restricted properties (e.g., `__proto__`) using strict equality (`===`) without prior string coercion. An attacker can bypass this check by providing a nested array (e.g., `['__proto__']`). During property access (`$O[$K]`), implicit string coercion turns the array into the restricted key, leading t
