On this page
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Weakness Summary
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
- Canonical source: MITRE CWE-1321 (opens in a new tab)
- Published Atomicorp CVE observations: 5
- Distinct affected products in those observations: 5
- Active Atomicorp rules associated with this weakness: 27
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2011-10019 | Spreecommerce 0.60.1 Arbitrary Command Execution | spree | Protected by Atomicorp rules | 340128 , 380018 , 390801 |
| CVE-2019-0230 | Apache Struts 2 Forced Multi OGNL Evaluation | struts | Protected by Atomicorp rules | 337209 , 337210 , 337211 , 344362 , 344363 |
| CVE-2021-20086 | Odoo Apps - Cross-Site Scripting via Prototype Pollution | jquery-bbq | Protected by Atomicorp rules | 333141 , 340099 , 340147 , 341099 , 341256 , 346755 , 347198 |
| CVE-2026-41690 | Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters | i18next-http-middleware | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-113659 | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated us | apostrophe | Protected by Atomicorp rules | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 333140 | Active | disruptive (deny) |
| 333141 | Active | disruptive (deny) |
| 337209 | Active | disruptive (deny) |
| 337210 | Active | disruptive (deny) |
| 337211 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340087 | Active | disruptive (deny) |
| 340095 | Active | disruptive (deny) |
| 340099 | Active | disruptive (deny) |
| 340128 | Active | disruptive (deny) |
| 340147 | Active | disruptive (deny) |
| 340148 | Active | disruptive (deny) |
| 341099 | Active | disruptive (deny) |
| 341256 | Active | disruptive (deny) |
| 341266 | Active | disruptive (deny) |
| 342259 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344362 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 346755 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 347198 | Active | disruptive (deny) |
| 350147 | Active | disruptive (deny) |
| 350148 | Active | disruptive (deny) |
| 380018 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390801 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:
CAPEC-1 (opens in a new tab) , CAPEC-180 (opens in a new tab) , CAPEC-77 (opens in a new tab)