CWE-13211 advisories

Prototype Pollution

What it is

Attacker-controlled keys (like __proto__) modify Object.prototype, corrupting application behaviour app-wide.

How to fix it

Upgrade the package; the fix usually rejects __proto__/constructor keys.

How to avoid it

Validate object keys, use Map or null-prototype objects, and avoid recursive merge of untrusted data.

Known Prototype Pollution vulnerabilities

Stateward flags Prototype Pollution in your own code and dependencies on every pull request.

Scan my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.