CVE-2026-44490

CVE-2026-44490 affects Axios prior to 0.32.0 and 1.16.0. Two read-side prototype-pollution gadgets allow polluted Object.prototype to affect request headers (lib/utils.js) and Object.defineProperty usage (lib/core/mergeConfig.js), causing polluted values to ride in headers and potentially TypeErr...

CVE-2026-44490 Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process e.g. lodash .merge / CVE-2018-16487, axios silently picks up the...

defu 安全漏洞

Defu is a lightweight tool library developed by UnJS for recursively merging default values. Versions of Defu prior to 6.1.5 contained security vulnerabilities; these vulnerabilities stemmed from the practice of passing uncleaned user input into the Defu functions, which could lead to prototype...

EUVD-2019-0225

Malware in sbrugna...

EUVD-2024-52320

Malicious code in bioql PyPI...

CVE-2024-54156

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack...

CVE-2024-54156

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack...

CVE-2024-54156

CVE-2024-54156 is linked to JetBrains YouTrack prior to 2024.3.52635, where multiple merge functions are vulnerable to a prototype pollution attack. The issue stems from uncontrolled modification of object prototype properties within the merge functions, enabling an attacker to alter object proto...

CVE-2024-54156

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack...

PT-2024-9170 · Jetbrains · Jetbrains Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.52635 Description: The issue is related to an uncontrolled modification of object prototype attributes in the data merge functions of JetBrains YouTrack. This can allow a remote attacker to implemen...

lutils 安全漏洞

lutils is a library of front-end code snippet collection tools. A security vulnerability exists in the lutils package that stems from the vulnerability of main merge functions to prototype contamination...

Prototype Pollution

Overview lodash.mergewith is a Lodash method .mergewith exported as a Node.js module. Affected versions of this package are vulnerable to Prototype Pollution. The functions merge, mergeWith, and defaultsDeep could be tricked into adding or modifying properties of Object.prototype. This is due to ...