CWE-1321 — Vulnerability Class 161

CWE-1321 represents a critical vulnerability where applications fail to restrict modifications to an object’s prototype attributes, allowing attackers to inject malicious properties into the global prototype chain. This weakness is typically exploited by crafting specific input payloads that target JavaScript objects, enabling the injection of arbitrary keys such as constructor or prototype references. Successful exploitation can lead to severe consequences, including remote code execution, denial of service, or privilege escalation, as the injected properties affect all subsequent instances of the affected object. To mitigate this risk, developers must implement strict input validation, utilize libraries that freeze prototypes, or employ object creation methods that do not inherit from the global prototype, such as Object.create(null). Additionally, avoiding the use of unsafe recursive merge functions and sanitizing user-controlled data before processing are essential practices for preventing prototype pollution attacks in modern web applications.