Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Detected `Reflect.has` used inside a recursive object merge function. `Reflect.has` traverses the prototype chain, which allows special keys like `__proto__` to be recognized as existing properties and traversed recursively, leading to Prototype Pollution. Use `Object.hasOwn()` and reject keys such as `__proto__`, `constructor`, and `prototype`.
Property iteration using a for-in loop writes properties to a target object without validating or skipping '__proto__'. This can lead to prototype pollution when extending or merging user-controlled objects.
Dynamically initializing and indexing nested object properties using unvalidated keys can lead to prototype pollution if a key equals `__proto__` or `constructor`. Use `Map`, `Object.create(null)`, or sanitize property keys.
Direct access to configuration properties without checking for own-property existence allows prototype pollution gadgets to inject unexpected parameters into requests.
Object property lookup using an unvalidated key allows built-in prototype properties (e.g., `__proto__`) to bypass simple truthiness checks. If the resolved inherited object is used improperly, this can lead to unhandled exceptions and Denial of Service (DoS). Validate that the property exists directly on the object using `Object.hasOwn()`, `.hasOwnProperty.
Dynamic traversal and nested object creation using split keys without validating against '__proto__', 'constructor', or 'prototype' can lead to prototype pollution.
A plain object `{}` is used as a dictionary map for objects from an array, with a key derived directly from the object's properties. If the key is controlled by an attacker (e.g., `__proto__`), this can lead to Prototype Pollution. Use `Object.create(null)` to safely store items without inheriting from `Object.prototype`.
Class field initialized as a plain object literal ({}) inherits from Object.prototype and is vulnerable to prototype pollution when modified with path-setting utilities like lodash.set. Use Object.create(null) to create a prototype-less object.
Unrestricted object property traversal using unvalidated user input path segments can lead to prototype pollution. If the traversal visits `__proto__`, it can return or modify the global object prototype. Ensure path segments are checked against unsafe keys like `__proto__`, `constructor`, and `prototype`.
Path segments derived from splitting a path string are returned without validating against dangerous property names like '__proto__', 'constructor', or 'prototype'. This can enable prototype pollution when the segments are used to access or modify object properties.
Checking property existence with the `in` operator can lead to prototype pollution when dealing with user-controlled keys. The `in` operator traverses the prototype chain and evaluates to true for internal properties like `__proto__` and `constructor`. If the property is then extracted and modified, it can pollute the global object prototype. Replace `in` wi
Cloning objects with `Object.assign({}, ...)` can lead to local prototype pollution if an input argument contains a malicious `__proto__` property (such as from parsed JSON). `Object.assign` invokes the `__proto__` setter on the new empty target object, altering its prototype chain. When this cloned object is subsequently merged, iterated via `for...in`, or
Using `RegExp.prototype.test` against a regex containing `__proto__`, `constructor`, or `prototype` as a prototype-pollution guard is bypassable. `RegExp.prototype.test` is a writable prototype method; an attacker that can override it (via another gadget in the same realm) can force the guard to return `false` and re-enable `Object.prototype` pollution throu
A String wrapper instance is used directly as an Array index without numeric coercion. Array property access for non-numeric string keys traverses the prototype chain, so an attacker-controlled value such as "__proto__" resolves to Array.prototype, leaking a live reference that enables prototype pollution (CWE-1321). Coerce the value with `+value` or validat
Possible prototype pollution (CWE-1321): assigning into a target object using a key obtained from another object's keys (Object.keys(...) or for..in) without first ensuring the property is an own property of the target. If the key is an inheritable name (e.g. `__proto__`, `constructor`, `prototype`, `toString`), the bracket-notation write traverses the proto
Iteration callback writes `$OBJ[$K] = $V` to a plain object without filtering prototype-polluting keys (e.g. '__proto__', 'constructor'). When the iterated collection's keys are attacker-controlled (e.g. an Immutable.Map built from `fromJS(JSON.parse(input))`), this triggers the prototype setter and pollutes the returned object's prototype (CVE-2026-29063, C
Using `Array.prototype.includes()` to guard against prototype-pollution keys ('__proto__', 'constructor', 'prototype') is bypassable. An attacker who can execute JavaScript in the same realm before this guard runs can shadow `Array.prototype.includes` (e.g., `Array.prototype.includes = () => false`), causing the check to silently pass and allowing the forbid
A recursive merge/assign callback writes to `result[key]` (and may recurse via a deep-merge call) without filtering the dangerous property names "__proto__", "constructor", and "prototype". When the source object is attacker-influenced (e.g., parsed JSON used as request config), iterating its keys and assigning them onto a fresh object pollutes Object.protot
Calling `.hasOwnProperty()` as an instance method in a function-property mutation guard is unsafe in sandbox or access-control code. When the guarded object is itself a prototype (e.g., `Map.prototype`), its built-in methods ARE own properties. As a result, `!obj.hasOwnProperty(prop)` evaluates to `false` and the guard silently permits the overwrite. This al
Calling hasOwnProperty() as a direct instance method on an object can be defeated by an attacker who supplies an object with a shadowed hasOwnProperty (e.g., { hasOwnProperty: () => true }). In sandbox or security-boundary code this causes prototype-access guards to silently pass, enabling host Object.prototype pollution. Use Object.prototype.hasOwnProperty.
Authentication compares a bracket-indexed object lookup (e.g. users[username]) to a value using loose equality (==). When the bracket key originates from untrusted input, an attacker can pass "__proto__" so the lookup returns Object.prototype, which is truthy and is coerced by == to "[object Object]" — matching a chosen password and bypassing authentication.
Registering separate custom schema validation rules on the same schema object overwrites earlier validation rules, allowing input validation bypass. Combine minLength, maxLength, and custom validation checks into a single custom rule handler.
Object path resolution function processes property selector paths without validating against '__proto__' or prototype properties. An attacker supplying a path containing '__proto__' can navigate or modify Object.prototype.
An incomplete blocklist was used to filter object keys. Filtering properties like `__proto__` and `constructor` but failing to filter essential `Object.prototype` properties like `toString`, `valueOf`, and `hasOwnProperty` can lead to application crashes (DoS) when overridden properties are unexpectedly executed. Consider validating against an extensive list
