134382 matches found
GHSA-VMG4-6GFG-83QX ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/" with a valid editor session and body of "toString.call":"x", overwriting the global toString function with value x. Fabian...
EUVD-2026-60442
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS...
NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
NPM: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.32.0...
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/" with a valid editor session and body of "toString.call":"x", overwriting the global toString function with value x. Fabian...
Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
Summary @tiptap/core's public mergeAttributes helper uses ordinary bracket assignment on keys returned by Object.entries. An own proto key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, whi...
Prototype Pollution
Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Prototype Pollution via the mergeAttributes function. An attacker can inject malicious prototype properties by supplying crafted objects with a proto key, which can result in inherited...
GHSA-CP6Q-959Q-F8RH Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
Summary @tiptap/core's public mergeAttributes helper uses ordinary bracket assignment on keys returned by Object.entries. An own proto key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, whi...
EUVD-2026-68765
Livewire DOM-based cross-site scripting during client-side state handling...
Prototype Pollution
Overview livewire/livewire is an A front-end framework for Laravel. Affected versions of this package are vulnerable to Prototype Pollution in the client-side state handling process. An attacker can execute arbitrary JavaScript in the context of the affected application by tricking a user into...
Malicious code in aril-22 (npm)
Source: amazon-inspector b0f2577669cd158adc95d4ba49cc8d76547208e7d11844fed48590a220d2088e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in aps-leod-manaro (npm)
Source: amazon-inspector 6e29ba1560e87d6804961e8cb3995f8f8e39e0523aeb05e4f81e80eda183d632 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in andi-rangginang63-sukiwir (npm)
Source: amazon-inspector 6ecd1823f954ac1d2dc3c1163376474235a65016d63f8aff798a9b919d4966a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in amateur_earthworm_z3n (npm)
Source: amazon-inspector 79eb14c54c44de8f8ec6d919524d1eafb5790b9f8ae7743f1293d23946754e93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in alone_harrier_z3n (npm)
Source: amazon-inspector d83ff3f9af88877b2aaf657bb5e891a4303b46ac154dac463d6ea1605ab9f948 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
ROOT-APP-NPM-CVE-2024-47068 CVE-2024-47068 in rollup - Patched by Root
Root has patched CVE-2024-47068 in the rollup package for Root:npm. Multiple fixed versions available...
PT-2026-90708
Summary @tiptap/core's public mergeAttributes helper uses ordinary bracket assignment on keys returned by Object.entries. An own proto key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, whi...
PT-2026-84825
Name of the Vulnerable Software and Affected Versions TOON versions prior to 2.3.1 Description Decoding attacker-controlled TOON data containing proto , constructor, or prototype keys allows for prototype pollution of Object.prototype for the runtime. This occurs because the software writes throu...
CVE-2026-82404: Improperly Controlled Modification of Object Prototype Attributes
TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In...
Prototype Pollution
Overview Affected versions of this package are vulnerable to Prototype Pollution via the compile and merge functions in lib/messages.js, where a language key named proto or constructor in a user-supplied messages object causes writes to flow onto Object.prototype rather than the intended target...
Prototype Pollution
Overview Affected versions of this package are vulnerable to Prototype Pollution via the compile and merge functions in lib/messages.js, where a language key named proto or constructor in a user-supplied messages object causes writes to flow onto Object.prototype rather than the intended target...